diff --git a/contrib/pf/authpf/authpf.c b/contrib/pf/authpf/authpf.c
index 14d3d41b6e21..b835737c5ee2 100644
--- a/contrib/pf/authpf/authpf.c
+++ b/contrib/pf/authpf/authpf.c
@@ -404,8 +404,8 @@ read_config(FILE *f)
 		if (ap != &pair[2])
 			goto parse_error;
 
-		tp = pair[1] + strlen(pair[1]);
-		while ((*tp == ' ' || *tp == '\t') && tp >= pair[1])
+		tp = pair[1] + strlen(pair[1]) - 1;
+		while (tp >= pair[1] && (*tp == ' ' || *tp == '\t'))
 			*tp-- = '\0';
 
 		if (strcasecmp(pair[0], "anchor") == 0) {