diff --git a/NEWS b/NEWS
index 6a9d9edd..ab7a16ce 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,7 @@ NEWS
   * Optimized buffer usage in mod_proxy (fixes #1850)
   * Fix uninitialized value in time struct after strptime
   * Do not pass Proxy-Connection: header from client to backend http server in mod_proxy (#1877)
+  * Fix wrong malloc sizes in mod_accesslog (probably nothing bad happened...) (fixes #1855, thx ycheng)
 
 - 1.4.20 - 2008-09-30
 
diff --git a/src/mod_accesslog.c b/src/mod_accesslog.c
index 420ef082..e5ba5534 100644
--- a/src/mod_accesslog.c
+++ b/src/mod_accesslog.c
@@ -169,13 +169,13 @@ int accesslog_parse_format(server *srv, format_fields *fields, buffer *format) {
 				if (fields->size == 0) {
 					fields->size = 16;
 					fields->used = 0;
-					fields->ptr = malloc(fields->size * sizeof(format_fields * ));
+					fields->ptr = malloc(fields->size * sizeof(format_field * ));
 				} else if (fields->used == fields->size) {
 					fields->size += 16;
-					fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_fields * ));
+					fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_field * ));
 				}
 
-				fields->ptr[fields->used] = malloc(sizeof(format_fields));
+				fields->ptr[fields->used] = malloc(sizeof(format_field));
 				fields->ptr[fields->used]->type = FIELD_STRING;
 				fields->ptr[fields->used]->string = buffer_init();
 
@@ -189,10 +189,10 @@ int accesslog_parse_format(server *srv, format_fields *fields, buffer *format) {
 			if (fields->size == 0) {
 				fields->size = 16;
 				fields->used = 0;
-				fields->ptr = malloc(fields->size * sizeof(format_fields * ));
+				fields->ptr = malloc(fields->size * sizeof(format_field * ));
 			} else if (fields->used == fields->size) {
 				fields->size += 16;
-				fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_fields * ));
+				fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_field * ));
 			}
 
 			/* search for the terminating command */
@@ -211,7 +211,7 @@ int accesslog_parse_format(server *srv, format_fields *fields, buffer *format) {
 
 					/* found key */
 
-					fields->ptr[fields->used] = malloc(sizeof(format_fields));
+					fields->ptr[fields->used] = malloc(sizeof(format_field));
 					fields->ptr[fields->used]->type = FIELD_FORMAT;
 					fields->ptr[fields->used]->field = fmap[j].type;
 					fields->ptr[fields->used]->string = NULL;
@@ -258,7 +258,7 @@ int accesslog_parse_format(server *srv, format_fields *fields, buffer *format) {
 
 					/* found key */
 
-					fields->ptr[fields->used] = malloc(sizeof(format_fields));
+					fields->ptr[fields->used] = malloc(sizeof(format_field));
 					fields->ptr[fields->used]->type = FIELD_FORMAT;
 					fields->ptr[fields->used]->field = fmap[j].type;
 					fields->ptr[fields->used]->string = buffer_init();
@@ -291,7 +291,7 @@ int accesslog_parse_format(server *srv, format_fields *fields, buffer *format) {
 
 					/* found key */
 
-					fields->ptr[fields->used] = malloc(sizeof(format_fields));
+					fields->ptr[fields->used] = malloc(sizeof(format_field));
 					fields->ptr[fields->used]->type = FIELD_FORMAT;
 					fields->ptr[fields->used]->field = fmap[j].type;
 					fields->ptr[fields->used]->string = NULL;
@@ -321,13 +321,13 @@ int accesslog_parse_format(server *srv, format_fields *fields, buffer *format) {
 		if (fields->size == 0) {
 			fields->size = 16;
 			fields->used = 0;
-			fields->ptr = malloc(fields->size * sizeof(format_fields * ));
+			fields->ptr = malloc(fields->size * sizeof(format_field * ));
 		} else if (fields->used == fields->size) {
 			fields->size += 16;
-			fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_fields * ));
+			fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_field * ));
 		}
 
-		fields->ptr[fields->used] = malloc(sizeof(format_fields));
+		fields->ptr[fields->used] = malloc(sizeof(format_field));
 		fields->ptr[fields->used]->type = FIELD_STRING;
 		fields->ptr[fields->used]->string = buffer_init();