diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 478714cdaced..cfc21cf670c0 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,7 @@
+2013-08-20  Martin Liska  <marxin.liska@gmail.com>
+
+	* ipa.c (ipa_profile_read_summary): Fix buffer overflow.
+
 2013-08-21  Rainer Orth  <ro@CeBiTec.Uni-Bielefeld.DE>
 
 	* config/sol2-10.h (TARGET_LIBC_HAS_FUNCTION): Don't nest
diff --git a/gcc/ipa.c b/gcc/ipa.c
index 1578aed70e8a..7e8a82cc4323 100644
--- a/gcc/ipa.c
+++ b/gcc/ipa.c
@@ -1397,7 +1397,7 @@ ipa_profile_read_summary (void)
 static unsigned int
 ipa_profile (void)
 {
-  struct cgraph_node **order = XCNEWVEC (struct cgraph_node *, cgraph_n_nodes);
+  struct cgraph_node **order;
   struct cgraph_edge *e;
   int order_pos;
   bool something_changed = false;
@@ -1575,6 +1575,7 @@ ipa_profile (void)
 	     nuseless, nuseless * 100.0 / nindirect,
 	     nconverted, nconverted * 100.0 / nindirect);
 
+  order = XCNEWVEC (struct cgraph_node *, cgraph_n_nodes);
   order_pos = ipa_reverse_postorder (order);
   for (i = order_pos - 1; i >= 0; i--)
     {