diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
index 8a340eb091..583429226d 100644
--- a/randr/rrproviderproperty.c
+++ b/randr/rrproviderproperty.c
@@ -182,7 +182,7 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
             cleanupProperty(prop, add);
             return BadAlloc;
         }
-        new_value.size = len;
+        new_value.size = total_len;
         new_value.type = type;
         new_value.format = format;
 
@@ -199,7 +199,7 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
         case PropModePrepend:
             new_data = new_value.data;
             old_data = (void *) (((char *) new_value.data) +
-                                  (prop_value->size * size_in_bytes));
+                                 (len * size_in_bytes));
             break;
         }
         if (new_data)