diff --git a/ChangeLog b/ChangeLog
index b6eb45309..aff32e50e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,10 @@
      [auth2-gss.c]
      Allow build without -DGSSAPI; ok deraadt@
      (Id sync only, Portable already has the ifdefs)
+   - dtucker@cvs.openbsd.org 2007/10/29 01:55:04
+     [ssh.c]
+     Plug tiny mem leaks in ControlPath and ProxyCommand option processing;
+     ok djm@
 
 20071030
  - (djm) OpenBSD CVS Sync
@@ -3425,4 +3429,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4797 2007/12/02 11:59:45 dtucker Exp $
+$Id: ChangeLog,v 1.4798 2007/12/02 12:01:03 dtucker Exp $
diff --git a/ssh.c b/ssh.c
index df3fc51ef..802ba6870 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.303 2007/09/04 11:15:55 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.304 2007/10/29 01:55:04 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -658,11 +658,15 @@ main(int ac, char **av)
 	}
 
 	if (options.proxy_command != NULL &&
-	    strcmp(options.proxy_command, "none") == 0)
+	    strcmp(options.proxy_command, "none") == 0) {
+		xfree(options.proxy_command);
 		options.proxy_command = NULL;
+	}
 	if (options.control_path != NULL &&
-	    strcmp(options.control_path, "none") == 0)
+	    strcmp(options.control_path, "none") == 0) {
+		xfree(options.control_path);
 		options.control_path = NULL;
+	}
 
 	if (options.control_path != NULL) {
 		char thishost[NI_MAXHOST];
@@ -672,6 +676,7 @@ main(int ac, char **av)
 		snprintf(buf, sizeof(buf), "%d", options.port);
 		cp = tilde_expand_filename(options.control_path,
 		    original_real_uid);
+		xfree(options.control_path);
 		options.control_path = percent_expand(cp, "p", buf, "h", host,
 		    "r", options.user, "l", thishost, (char *)NULL);
 		xfree(cp);