Index: loader.c
===================================================================
--- loader.c	(revision 926)
+++ loader.c	(revision 928)
@@ -259,14 +259,14 @@
 		char *challenge = ldr_get_field(&line);
  
 		if (strncmp(options.format, "netlm", 5)==0) {
-			tmp = (char *) mem_alloc(7 + strlen(challenge) + strlen(netlm) + 1);
-			memset(tmp, 0, 7 + strlen(challenge) + strlen(netlm) + 1);
+			tmp = (char *) mem_alloc(7 + strlen(challenge) + 1 + strlen(netlm) + 1);
+			memset(tmp, 0, 7 + strlen(challenge) + 1 + strlen(netlm) + 1);
 			sprintf(tmp, "$NETLM$%s$%s", challenge, netlm);
 			*ciphertext = tmp;
 		}
 		else {
-			tmp = (char *) mem_alloc(9 + strlen(challenge) + strlen(netntlm) + 1);
-			memset(tmp, 0, 9 + strlen(challenge) + strlen(netntlm) + 1);
+			tmp = (char *) mem_alloc(9 + strlen(challenge) + 1 + strlen(netntlm) + 1);
+			memset(tmp, 0, 9 + strlen(challenge) + 1 + strlen(netntlm) + 1);
 			sprintf(tmp, "$NETNTLM$%s$%s", challenge, netntlm);
 			*ciphertext = tmp;
 		}