diff --git a/trunk/src/rtmp/srs_protocol_stack.cpp b/trunk/src/rtmp/srs_protocol_stack.cpp
index 128253474..5589ecd04 100644
--- a/trunk/src/rtmp/srs_protocol_stack.cpp
+++ b/trunk/src/rtmp/srs_protocol_stack.cpp
@@ -755,17 +755,10 @@ int SrsProtocol::do_send_messages(SrsSharedPtrMessage** msgs, int nb_msgs)
         
         // always write the header event payload is empty.
         while (p < pend) {
-            // always has header
-            int nbh = 0;
-            char* header = NULL;
-            generate_chunk_header(c0c3_cache, &msg->header, p == msg->payload, &nbh, &header);
-            srs_assert(nbh > 0);
+            // header use iov[0].
+            generate_chunk_header(c0c3_cache, &msg->header, p == msg->payload, iov);
             
-            // header iov
-            iov[0].iov_base = header;
-            iov[0].iov_len = nbh;
-            
-            // payload iov
+            // payload use iov[1].
             int payload_size = pend - p;
             if (payload_size > out_chunk_size) {
                 payload_size = out_chunk_size;
@@ -788,14 +781,14 @@ int SrsProtocol::do_send_messages(SrsSharedPtrMessage** msgs, int nb_msgs)
                 int realloc_size = sizeof(iovec) * nb_out_iovs;
                 out_iovs = (iovec*)realloc(out_iovs, realloc_size);
             }
+
+            // to next c0c3 header cache
+            c0c3_cache_index += iov[0].iov_len;
+            c0c3_cache = out_c0c3_caches + c0c3_cache_index;
             
             // to next pair of iovs
             iov_index += 2;
             iov = out_iovs + iov_index;
-
-            // to next c0c3 header cache
-            c0c3_cache_index += nbh;
-            c0c3_cache = out_c0c3_caches + c0c3_cache_index;
             
             // the cache header should never be realloc again,
             // for the ptr is set to iovs, so we just warn user to set larger
@@ -905,7 +898,7 @@ int SrsProtocol::do_send_and_free_packet(SrsPacket* packet, int stream_id)
     return ret;
 }
 
-void SrsProtocol::generate_chunk_header(char* cache, SrsMessageHeader* mh, bool c0, int* pnbh, char** ph) 
+void SrsProtocol::generate_chunk_header(char* cache, SrsMessageHeader* mh, bool c0, iovec* iov)
 {
     // to directly set the field.
     char* pp = NULL;
@@ -982,8 +975,8 @@ void SrsProtocol::generate_chunk_header(char* cache, SrsMessageHeader* mh, bool
     }
     
     // always has header
-    *pnbh = p - cache;
-    *ph = cache;
+    iov->iov_base = cache;
+    iov->iov_len = p - cache;
 }
 
 int SrsProtocol::do_decode_message(SrsMessageHeader& header, SrsStream* stream, SrsPacket** ppacket)
diff --git a/trunk/src/rtmp/srs_protocol_stack.hpp b/trunk/src/rtmp/srs_protocol_stack.hpp
index b99f359c3..e19a18c96 100644
--- a/trunk/src/rtmp/srs_protocol_stack.hpp
+++ b/trunk/src/rtmp/srs_protocol_stack.hpp
@@ -496,11 +496,9 @@ private:
     * generate the chunk header for msg.
     * @param mh, the header of msg to send.
     * @param c0, whether the first chunk, the c0 chunk.
-    * @param pnbh, output the size of header.
-    * @param ph, output the header cache.
-    *       user should never free it, it's cached header.
+    * @param iov, output the header and size to iovec.
     */
-    virtual void generate_chunk_header(char* cache, SrsMessageHeader* mh, bool c0, int* pnbh, char** ph);
+    virtual void generate_chunk_header(char* cache, SrsMessageHeader* mh, bool c0, iovec* iov);
     /**
     * imp for decode_message
     */