diff --git a/CHANGELOG b/CHANGELOG
index 853c9ebb..d8296bd7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -238,6 +238,10 @@ HISTORY
 
   ++ Bug fixes:
 
+  2007-06-25 Simon Goldschmidt
+  * udp.c: Fixed bug #20253: icmp_dest_unreach was called with a wrong p->payload
+    for udp packets with no matching pcb.
+
   2007-06-25 Simon Goldschmidt
   * udp.c: Fixed bug #20220: UDP PCB search in udp_input(): a non-local match
     could get udp input packets if the remote side matched.
diff --git a/src/core/udp.c b/src/core/udp.c
index 17e9560b..b9b3a736 100644
--- a/src/core/udp.c
+++ b/src/core/udp.c
@@ -257,7 +257,7 @@ udp_input(struct pbuf *p, struct netif *inp)
       if (!ip_addr_isbroadcast(&iphdr->dest, inp) &&
           !ip_addr_ismulticast(&iphdr->dest)) {
         /* move payload pointer back to ip header */
-        pbuf_header(p, (IPH_HL(iphdr) * 4));
+        pbuf_header(p, (IPH_HL(iphdr) * 4) + UDP_HLEN);
         LWIP_ASSERT("p->payload == iphdr", (p->payload == iphdr));
         icmp_dest_unreach(p, ICMP_DUR_PORT);
       }