diff --git a/ChangeLog b/ChangeLog
index 943c75491..1da850aab 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -36,6 +36,10 @@
      [auth2-gss.c]
      GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
      reviewed by simon AT sxw.org.uk; deraadt@ ok
+   - djm@cvs.openbsd.org 2006/03/20 04:07:49
+     [gss-genr.c]
+     more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
+     reviewed by simon AT sxw.org.uk; deraadt@ ok
 
 20060318
  - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
@@ -4228,4 +4232,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.4234 2006/03/25 13:04:53 djm Exp $
+$Id: ChangeLog,v 1.4235 2006/03/25 13:05:23 djm Exp $
diff --git a/gss-genr.c b/gss-genr.c
index c2b4f2dd8..8d75ee5c7 100644
--- a/gss-genr.c
+++ b/gss-genr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gss-genr.c,v 1.6 2005/10/13 22:24:31 stevesk Exp $	*/
+/*	$OpenBSD: gss-genr.c,v 1.7 2006/03/20 04:07:49 djm Exp $	*/
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -72,7 +72,11 @@ ssh_gssapi_set_oid(Gssctxt *ctx, gss_OID oid)
 void
 ssh_gssapi_error(Gssctxt *ctxt)
 {
-	debug("%s", ssh_gssapi_last_error(ctxt, NULL, NULL));
+	char *s;
+
+	s = ssh_gssapi_last_error(ctxt, NULL, NULL);
+	debug("%s", s);
+	xfree(s);
 }
 
 char *
@@ -231,11 +235,15 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx)
 	gss_create_empty_oid_set(&status, &oidset);
 	gss_add_oid_set_member(&status, ctx->oid, &oidset);
 
-	if (gethostname(lname, MAXHOSTNAMELEN))
+	if (gethostname(lname, MAXHOSTNAMELEN)) {
+		gss_release_oid_set(&status, &oidset);
 		return (-1);
+	}
 
-	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname)))
+	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
+		gss_release_oid_set(&status, &oidset);
 		return (ctx->major);
+	}
 
 	if ((ctx->major = gss_acquire_cred(&ctx->minor,
 	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))