diff --git a/examples/dpfp.c b/examples/dpfp.c
index a5151f2c..c56e8d8c 100644
--- a/examples/dpfp.c
+++ b/examples/dpfp.c
@@ -168,8 +168,7 @@ static void cb_mode_changed(struct libusb_transfer *transfer)
 
 static int set_mode_async(unsigned char data)
 {
-	int bufsize = LIBUSB_CONTROL_SETUP_SIZE + 1;
-	unsigned char *buf = malloc(bufsize);
+	unsigned char *buf = malloc(LIBUSB_CONTROL_SETUP_SIZE + 1);
 	struct libusb_transfer *transfer;
 
 	if (!buf)
@@ -184,8 +183,8 @@ static int set_mode_async(unsigned char data)
 	printf("async set mode %02x\n", data);
 	libusb_fill_control_setup(buf, CTRL_OUT, USB_RQ, 0x4e, 0, 1);
 	buf[LIBUSB_CONTROL_SETUP_SIZE] = data;
-	libusb_fill_control_transfer(transfer, devh, buf, bufsize,
-		cb_mode_changed, NULL, 1000);
+	libusb_fill_control_transfer(transfer, devh, buf, cb_mode_changed, NULL,
+		1000);
 
 	return libusb_submit_transfer(transfer);
 }
diff --git a/libusb/libusb.h b/libusb/libusb.h
index 34133011..a697e4ee 100644
--- a/libusb/libusb.h
+++ b/libusb/libusb.h
@@ -270,15 +270,17 @@ void libusb_free_transfer(struct libusb_transfer *transfer);
 
 static inline void libusb_fill_control_transfer(
 	struct libusb_transfer *transfer, libusb_device_handle *dev_handle,
-	unsigned char *buffer, int length, libusb_transfer_cb_fn callback,
-	void *user_data, unsigned int timeout)
+	unsigned char *buffer, libusb_transfer_cb_fn callback, void *user_data,
+	unsigned int timeout)
 {
+	struct libusb_control_setup *setup = (struct libusb_control_setup *) buffer;
 	transfer->dev_handle = dev_handle;
 	transfer->endpoint = 0;
 	transfer->endpoint_type = LIBUSB_ENDPOINT_TYPE_CONTROL;
 	transfer->timeout = timeout;
 	transfer->buffer = buffer;
-	transfer->length = length;
+	if (setup)
+		transfer->length = LIBUSB_CONTROL_SETUP_SIZE + setup->wLength;
 	transfer->user_data = user_data;
 	transfer->callback = callback;
 }
diff --git a/libusb/sync.c b/libusb/sync.c
index d4004706..bfff4e9e 100644
--- a/libusb/sync.c
+++ b/libusb/sync.c
@@ -39,14 +39,13 @@ API_EXPORTED int libusb_control_transfer(libusb_device_handle *dev_handle,
 {
 	struct libusb_transfer *transfer = libusb_alloc_transfer();
 	unsigned char *buffer;
-	int length = wLength + LIBUSB_CONTROL_SETUP_SIZE;
 	int completed = 0;
 	int r;
 
 	if (!transfer)
 		return -ENOMEM;
 	
-	buffer = malloc(length);
+	buffer = malloc(LIBUSB_CONTROL_SETUP_SIZE + wLength);
 	if (!buffer) {
 		libusb_free_transfer(transfer);
 		return -ENOMEM;
@@ -57,7 +56,7 @@ API_EXPORTED int libusb_control_transfer(libusb_device_handle *dev_handle,
 	if ((bRequestType & LIBUSB_ENDPOINT_DIR_MASK) == LIBUSB_ENDPOINT_OUT)
 		memcpy(buffer + LIBUSB_CONTROL_SETUP_SIZE, data, wLength);
 
-	libusb_fill_control_transfer(transfer, dev_handle, buffer, length,
+	libusb_fill_control_transfer(transfer, dev_handle, buffer,
 		ctrl_transfer_cb, &completed, timeout);
 	r = libusb_submit_transfer(transfer);
 	if (r < 0) {