diff --git a/ChangeLog b/ChangeLog
index 19dc33403..7a3f272e1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,9 @@
    - jmc@cvs.openbsd.org 2012/12/03 08:33:03
      [ssh-add.1 sshd_config.5]
      tweak previous;
+   - markus@cvs.openbsd.org 2012/12/05 15:42:52
+     [ssh-add.c]
+     prevent double-free of comment; ok djm@
 
 20121205
  - (tim) [defines.h] Some platforms are missing ULLONG_MAX. Feedback djm@.
diff --git a/ssh-add.c b/ssh-add.c
index c8936e5ae..008084704 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.104 2012/12/02 20:42:15 djm Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.105 2012/12/05 15:42:52 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -118,6 +118,7 @@ delete_file(AuthenticationConnection *ac, const char *filename, int key_only)
 
 	/* Now try to delete the corresponding certificate too */
 	free(comment);
+	comment = NULL;
 	xasprintf(&certpath, "%s-cert.pub", filename);
 	if ((cert = key_load_public(certpath, &comment)) == NULL)
 		goto out;