diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index d68151be3..bdd228fd9 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -5231,9 +5231,12 @@ static int bind_parse_npn(char **args, int cur_arg, struct proxy *px, struct bin
 
 	free(conf->npn_str);
 
-	/* the NPN string is built as a suite of (<len> <name>)* */
+	/* the NPN string is built as a suite of (<len> <name>)*,
+	 * so we reuse each comma to store the next <len> and need
+	 * one more for the end of the string.
+	 */
 	conf->npn_len = strlen(args[cur_arg + 1]) + 1;
-	conf->npn_str = calloc(1, conf->npn_len);
+	conf->npn_str = calloc(1, conf->npn_len + 1);
 	memcpy(conf->npn_str + 1, args[cur_arg + 1], conf->npn_len);
 
 	/* replace commas with the name length */