--- camel/camel-object.c.orig	Tue Feb 14 17:37:31 2006
+++ camel/camel-object.c	Tue Feb 14 17:42:18 2006
@@ -449,15 +449,18 @@ cobject_state_read(CamelObject *obj, FIL
 
 	if (version > 0) {
 		CamelArgV *argv;
+		guint32 ocount;
 
 		if (camel_file_util_decode_uint32(fp, &count) == -1
 			|| count == 0 || count > 1024) {
 			/* maybe it was just version 0 afterall */
 			return 0;
 		}
+
+		ocount = (count <= CAMEL_ARGV_MAX) ? count : (count - CAMEL_ARGV_MAX);
 		
 		/* we batch up the properties and set them in one go */
-		if (!(argv = g_try_malloc (sizeof (*argv) + (count - CAMEL_ARGV_MAX) * sizeof (argv->argv[0]))))
+		if (!(argv = g_try_malloc (sizeof (*argv) + ocount * sizeof (argv->argv[0]))))
 			return -1;
 		
 		argv->argc = 0;
@@ -537,8 +540,10 @@ cobject_state_write(CamelObject *obj, FI
 
 	count = g_slist_length(props);
 
-	arggetv = g_malloc0(sizeof(*arggetv) + (count - CAMEL_ARGV_MAX) * sizeof(arggetv->argv[0]));
-	argv = g_malloc0(sizeof(*argv) + (count - CAMEL_ARGV_MAX) * sizeof(argv->argv[0]));
+	ocount = (count <= CAMEL_ARGV_MAX) ? count : (count - CAMEL_ARGV_MAX);
+
+	arggetv = g_malloc0(sizeof(*arggetv) + ocount * sizeof(arggetv->argv[0]));
+	argv = g_malloc0(sizeof(*argv) + ocount * sizeof(argv->argv[0]));
 	l = props;
 	i = 0;
 	while (l) {
