diff --git a/ChangeLog b/ChangeLog
index 977a4a63b..1cc5c87c8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2012-01-17  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
+	[gxvalid] Fix Savannah bug #35286.
+
+	Patch submitted by anonymous reporter.
+
+	* src/gxvalid/gxvcommn.c (gxv_XStateTable_subtable_setup):
+	gxv_set_length_by_ulong_offset() must be called with 3, not 4,
+	the number of the subtables in the state tables; classTable,
+	stateArray, entryTable.
+
 2012-01-17  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
 
 	[raccess] Modify for PIC build.
diff --git a/src/gxvalid/gxvcommn.c b/src/gxvalid/gxvcommn.c
index d3c48d4ea..0fdfba294 100644
--- a/src/gxvalid/gxvcommn.c
+++ b/src/gxvalid/gxvcommn.c
@@ -1334,7 +1334,7 @@
     l[1] = stateArray_length_p;
     l[2] = entryTable_length_p;
 
-    gxv_set_length_by_ulong_offset( o, l, buff, 4, table_size, valid );
+    gxv_set_length_by_ulong_offset( o, l, buff, 3, table_size, valid );
   }