diff --git a/CHANGELOG b/CHANGELOG
index 0579a6be..645e9eb8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -66,6 +66,9 @@ HISTORY
 
  ++ Bugfixes:
 
+  2012-03-27: Simon Goldschmidt
+  * vj.c: fixed bug #35756 header length calculation problem in ppp/vj.c
+
   2012-03-27: Simon Goldschmidt (patch by Mason)
   * tcp_out.c: fixed bug #35945: SYN packet should provide the recv MSS not the
     send MSS
diff --git a/src/include/lwip/tcp_impl.h b/src/include/lwip/tcp_impl.h
index d3739acf..173de44e 100644
--- a/src/include/lwip/tcp_impl.h
+++ b/src/include/lwip/tcp_impl.h
@@ -171,11 +171,9 @@ PACK_STRUCT_END
 #  include "arch/epstruct.h"
 #endif
 
-#define TCPH_OFFSET(phdr) (ntohs((phdr)->_hdrlen_rsvd_flags) >> 8)
 #define TCPH_HDRLEN(phdr) (ntohs((phdr)->_hdrlen_rsvd_flags) >> 12)
 #define TCPH_FLAGS(phdr)  (ntohs((phdr)->_hdrlen_rsvd_flags) & TCP_FLAGS)
 
-#define TCPH_OFFSET_SET(phdr, offset) (phdr)->_hdrlen_rsvd_flags = htons(((offset) << 8) | TCPH_FLAGS(phdr))
 #define TCPH_HDRLEN_SET(phdr, len) (phdr)->_hdrlen_rsvd_flags = htons(((len) << 12) | TCPH_FLAGS(phdr))
 #define TCPH_FLAGS_SET(phdr, flags) (phdr)->_hdrlen_rsvd_flags = (((phdr)->_hdrlen_rsvd_flags & PP_HTONS((u16_t)(~(u16_t)(TCP_FLAGS)))) | htons(flags))
 #define TCPH_HDRLEN_FLAGS_SET(phdr, len, flags) (phdr)->_hdrlen_rsvd_flags = htons(((len) << 12) | (flags))
diff --git a/src/netif/ppp/vj.c b/src/netif/ppp/vj.c
index bce33221..40fdad13 100644
--- a/src/netif/ppp/vj.c
+++ b/src/netif/ppp/vj.c
@@ -213,7 +213,7 @@ vj_compress_tcp(struct vjcompress *comp, struct pbuf *pb)
      */
     INCR(vjs_misses);
     comp->last_cs = lcs;
-    hlen += TCPH_OFFSET(th);
+    hlen += TCPH_HDRLEN(th);
     hlen <<= 2;
     /* Check that the IP/TCP headers are contained in the first buffer. */
     if (hlen > pb->len) {
@@ -236,7 +236,7 @@ vj_compress_tcp(struct vjcompress *comp, struct pbuf *pb)
 
   oth = (struct tcp_hdr *)&((long *)&cs->cs_ip)[hlen];
   deltaS = hlen;
-  hlen += TCPH_OFFSET(th);
+  hlen += TCPH_HDRLEN(th);
   hlen <<= 2;
   /* Check that the IP/TCP headers are contained in the first buffer. */
   if (hlen > pb->len) {
@@ -258,9 +258,9 @@ vj_compress_tcp(struct vjcompress *comp, struct pbuf *pb)
   if (((u_short *)ip)[0] != ((u_short *)&cs->cs_ip)[0] 
       || ((u_short *)ip)[3] != ((u_short *)&cs->cs_ip)[3] 
       || ((u_short *)ip)[4] != ((u_short *)&cs->cs_ip)[4] 
-      || TCPH_OFFSET(th) != TCPH_OFFSET(oth) 
+      || TCPH_HDRLEN(th) != TCPH_HDRLEN(oth) 
       || (deltaS > 5 && BCMP(ip + 1, &cs->cs_ip + 1, (deltaS - 5) << 2)) 
-      || (TCPH_OFFSET(th) > 5 && BCMP(th + 1, oth + 1, (TCPH_OFFSET(th) - 5) << 2))) {
+      || (TCPH_HDRLEN(th) > 5 && BCMP(th + 1, oth + 1, (TCPH_HDRLEN(th) - 5) << 2))) {
     goto uncompressed;
   }
 
@@ -434,7 +434,7 @@ vj_uncompress_uncomp(struct pbuf *nb, struct vjcompress *comp)
   hlen = IPH_HL(ip) << 2;
   if (IPH_PROTO(ip) >= MAX_SLOTS
       || hlen + sizeof(struct tcp_hdr) > nb->len
-      || (hlen += TCPH_OFFSET(((struct tcp_hdr *)&((char *)ip)[hlen])) << 2)
+      || (hlen += TCPH_HDRLEN(((struct tcp_hdr *)&((char *)ip)[hlen])) << 2)
           > nb->len
       || hlen > MAX_HDR) {
     PPPDEBUG(LOG_INFO, ("vj_uncompress_uncomp: bad cid=%d, hlen=%d buflen=%d\n",