Index: ssl/d1_both.c
===================================================================
RCS file: /v/openssl/cvs/openssl/ssl/d1_both.c,v
retrieving revision 1.14.2.21.2.7
diff -u -r1.14.2.21.2.7 d1_both.c
--- ssl/d1_both.c	31 Dec 2011 23:00:35 -0000	1.14.2.21.2.7
+++ ssl/d1_both.c	27 Feb 2012 10:00:49 -0000
@@ -1478,8 +1478,9 @@
 		*bp++ = TLS1_HB_RESPONSE;
 		s2n(payload, bp);
 		memcpy(bp, pl, payload);
+		bp += payload;
 		/* Random padding */
-		RAND_pseudo_bytes(p, padding);
+		RAND_pseudo_bytes(bp, padding);
 
 		r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
 
Index: ssl/t1_lib.c
===================================================================
RCS file: /v/openssl/cvs/openssl/ssl/t1_lib.c,v
retrieving revision 1.64.2.14.2.30
diff -u -r1.64.2.14.2.30 t1_lib.c
--- ssl/t1_lib.c	17 Feb 2012 17:31:32 -0000	1.64.2.14.2.30
+++ ssl/t1_lib.c	27 Feb 2012 10:00:49 -0000
@@ -2467,7 +2467,10 @@
 		*bp++ = TLS1_HB_RESPONSE;
 		s2n(payload, bp);
 		memcpy(bp, pl, payload);
-		
+		bp += payload;
+		/* Random padding */
+		RAND_pseudo_bytes(bp, padding);
+
 		r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
 
 		if (r >= 0 && s->msg_callback)