diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c
index 8d6fd1fb2cdcc24f70e6594e2ce20d58470042e7..84f6dfb4c2376c85ce2cbe89b9d4f7737895df82 100644
--- a/ssl/statem/statem_srvr.c
+++ b/ssl/statem/statem_srvr.c
@@ -3470,7 +3470,8 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,
          * slightly over allocate because we won't store those. But that isn't a
          * problem.
          */
-        raw = s->s3->tmp.ciphers_raw = OPENSSL_malloc(numciphers * n);
+        raw = OPENSSL_malloc(numciphers * TLS_CIPHER_LEN);
+        s->s3->tmp.ciphers_raw = raw;
         if (raw == NULL) {
             *al = SSL_AD_INTERNAL_ERROR;
             goto err;