diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,9 @@
 # Revision history for cryptostore
 
+## 0.2.2.0 - 2022-04-16
+
+* Fix buffer overrun in `pkcs12Derive`
+
 ## 0.2.1.0 - 2019-10-13
 
 * Added CMS fuctions `contentInfoToDER` and `berToContentInfo` in order to
diff --git a/LICENSE b/LICENSE
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2018-2019, Olivier Chéron
+Copyright (c) 2018-2022, Olivier Chéron
 
 All rights reserved.
 
diff --git a/cryptostore.cabal b/cryptostore.cabal
--- a/cryptostore.cabal
+++ b/cryptostore.cabal
@@ -1,5 +1,5 @@
 name:                cryptostore
-version:             0.2.1.0
+version:             0.2.2.0
 synopsis:            Serialization of cryptographic data types
 description:         Haskell implementation of PKCS \#8, PKCS \#12 and CMS
                      (Cryptographic Message Syntax).
diff --git a/src/Crypto/Store/PKCS5/PBES1.hs b/src/Crypto/Store/PKCS5/PBES1.hs
--- a/src/Crypto/Store/PKCS5/PBES1.hs
+++ b/src/Crypto/Store/PKCS5/PBES1.hs
@@ -288,7 +288,7 @@
     B.allocAndFreeze n $ \pout ->
         B.withByteArray bs $ \pin -> do
             mapM_ (\off -> memCopy (pout `plusPtr` off) pin len)
-                  (enumFromThenTo 0 len (n - 1))
+                  (enumFromThenTo 0 len (n - len))
             memCopy (pout `plusPtr` (n - r)) pin r
   where
     len = B.length bs