diff --git a/core/src/main/java/jenkins/security/LastGrantedAuthoritiesProperty.java b/core/src/main/java/jenkins/security/LastGrantedAuthoritiesProperty.java
index a506b2324392e13595d6a8cb9517d1c6780f7988..3fca03da5360dfae20820e0fcbe945aa5498d601 100644
--- a/core/src/main/java/jenkins/security/LastGrantedAuthoritiesProperty.java
+++ b/core/src/main/java/jenkins/security/LastGrantedAuthoritiesProperty.java
@@ -50,7 +50,7 @@ public class LastGrantedAuthoritiesProperty extends UserProperty {
         GrantedAuthority[] r = new GrantedAuthority[roles==null ? 1 : roles.length+1];
         r[0] = SecurityRealm.AUTHENTICATED_AUTHORITY;
         if (roles != null) {
-            for (int i = 1; i < roles.length; i++) {
+            for (int i = 1; i < r.length; i++) {
                 r[i] = new GrantedAuthorityImpl(roles[i - 1]);
             }
         }