diff --git a/ChangeLog b/ChangeLog
index d00d04263..083314ccb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,9 @@
    - jmc@cvs.openbsd.org 2003/05/20 12:09:31
      [ssh.1 ssh_config.5 sshd.8 sshd_config.5 ssh-keygen.1]
      new sentence, new line
+   - djm@cvs.openbsd.org 2003/05/23 08:29:30
+     [sshconnect.c]
+     fix leak; ok markus@
 
 20030520
  - (djm) OpenBSD CVS Sync
@@ -1599,4 +1602,4 @@
      save auth method before monitor_reset_key_state(); bugzilla bug #284;
      ok provos@
 
-$Id: ChangeLog,v 1.2747 2003/05/23 08:44:23 djm Exp $
+$Id: ChangeLog,v 1.2748 2003/05/23 08:44:41 djm Exp $
diff --git a/sshconnect.c b/sshconnect.c
index 8aac221d3..dfa2e5b09 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.141 2003/05/15 14:55:25 djm Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.142 2003/05/23 08:29:30 djm Exp $");
 
 #include <openssl/bn.h>
 
@@ -225,7 +225,7 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
 	fd_set *fdset;
 	struct timeval tv;
 	socklen_t optlen;
-	int fdsetsz, optval, rc;
+	int fdsetsz, optval, rc, result = -1;
 
 	if (timeout <= 0)
 		return (connect(sockfd, serv_addr, addrlen));
@@ -257,11 +257,11 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
 	case 0:
 		/* Timed out */
 		errno = ETIMEDOUT;
-		return (-1);
+		break;
 	case -1:
 		/* Select error */
 	    	debug("select: %s", strerror(errno));
-		return (-1);
+		break;
 	case 1:
 		/* Completed or failed */
 		optval = 0;
@@ -269,18 +269,20 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
 		if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval, 
 		    &optlen) == -1)
 		    	debug("getsockopt: %s", strerror(errno));
-			return (-1);
+			break;
 		if (optval != 0) {
 			errno = optval;
-			return (-1);
+			break;
 		}
+		result = 0;
 		break;
 	default:
 		/* Should not occur */
 		fatal("Bogus return (%d) from select()", rc);
 	}
 
-	return (0);
+	xfree(fdset);
+	return (result);
 }
 
 /*