2 files changed, 9 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index 7b05bd269..b09f7a306 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -7,6 +7,9 @@ openssh (1:5.1p1-4) UNRELEASED; urgency=low
     - Only send eow and no-more-sessions requests to openssh 5 and newer;
       fixes interop problems with broken ssh v2 implementations (closes:
       #495917).
+  * Fix double-free when failing to parse a forwarding specification given
+    using ~C (closes: #505330; forwarded upstream as
+    https://bugzilla.mindrot.org/show_bug.cgi?id=1539).
 
  -- Colin Watson <cjwatson@debian.org>  Thu, 09 Oct 2008 12:52:34 +0100
 
diff --git a/readconf.c b/readconf.c
index 7ad5a8e18..043673ced 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1334,9 +1334,13 @@ parse_forward(Forward *fwd, const char *fwdspec)
         return (i);
 
  fail_free:
-        if (fwd->connect_host != NULL)
+        if (fwd->connect_host != NULL) {
                 xfree(fwd->connect_host);
-        if (fwd->listen_host != NULL)
+                fwd->connect_host = NULL;
+        }
+        if (fwd->listen_host != NULL) {
                 xfree(fwd->listen_host);
+                fwd->connect_host = NULL;
+        }
         return (0);
 }