diff --git a/src/dnsmasq/tftp.c b/src/dnsmasq/tftp.c
index 637a566f2..831d2f241 100644
--- a/src/dnsmasq/tftp.c
+++ b/src/dnsmasq/tftp.c
@@ -360,7 +360,7 @@ void tftp_request(struct listener *listen, time_t now)
     }
   
   p = packet + 2;
-  end = packet + 2 + len;
+  end = packet + len;
   
   if (ntohs(*((unsigned short *)packet)) != OP_RRQ ||
       !(filename = next(&p, end)) ||