diff --git a/ChangeLog b/ChangeLog
index 033e483c7..13e1f3606 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+20010314
+ - OpenBSD CVS Sync
+  - markus@cvs.openbsd.org 2001/03/13 17:34:42
+    [auth-options.c]
+    missing xfree, deny key on parse error; ok stevesk@
+
 20010313
  - OpenBSD CVS Sync
    - markus@cvs.openbsd.org 2001/03/12 22:02:02
@@ -4531,4 +4537,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.951 2001/03/13 04:57:58 mouring Exp $
+$Id: ChangeLog,v 1.952 2001/03/13 23:15:20 djm Exp $
diff --git a/auth-options.c b/auth-options.c
index 57e335f3f..bfb1af86b 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-options.c,v 1.13 2001/02/09 13:38:07 markus Exp $");
+RCSID("$OpenBSD: auth-options.c,v 1.14 2001/03/13 17:34:42 markus Exp $");
 
 #include "packet.h"
 #include "xmalloc.h"
@@ -118,7 +118,9 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				packet_send_debug("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				continue;
+				xfree(forced_command);
+				forced_command = NULL;
+				goto bad_option;
 			}
 			forced_command[i] = 0;
 			packet_send_debug("Forced command: %.900s", forced_command);
@@ -148,7 +150,8 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				packet_send_debug("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				continue;
+				xfree(s);
+				goto bad_option;
 			}
 			s[i] = 0;
 			packet_send_debug("Adding to environment: %.900s", s);
@@ -185,7 +188,8 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				packet_send_debug("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				continue;
+				xfree(patterns);
+				goto bad_option;
 			}
 			patterns[i] = 0;
 			opts++;