diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index cba8d6945..9c0be23b1 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -245,7 +245,7 @@ generate_dh_keyblock(krb5_context context,
 	}
 	if (dh_gen_keylen < size) {
 	    size -= dh_gen_keylen;
-	    memmove(dh_gen_key + size, dh_gen_key, size);
+	    memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
 	    memset(dh_gen_key, 0, size);
 	}
 
diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
index 46e883593..92c1200f0 100644
--- a/lib/krb5/pkinit.c
+++ b/lib/krb5/pkinit.c
@@ -1435,7 +1435,7 @@ pk_rd_pa_reply_dh(krb5_context context,
 	}
 	if (dh_gen_keylen < size) {
 	    size -= dh_gen_keylen;
-	    memmove(dh_gen_key + size, dh_gen_key, size);
+	    memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
 	    memset(dh_gen_key, 0, size);
 	}