diff --git a/ChangeLog b/ChangeLog
index 8fcd17d06..38bd45060 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+19991230
+ - OpenBSD CVS updates:
+   - [auth-passwd.c]
+     check for NULL 1st
+
 19991229
  - Applied another NetBSD portability patch from David Rankin 
    <drankin@bohemians.lexington.ky.us>
diff --git a/auth-passwd.c b/auth-passwd.c
index 0311a493e..e91893ae5 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -11,7 +11,7 @@
 
 #ifndef USE_PAM
 
-RCSID("$Id: auth-passwd.c,v 1.12 1999/12/28 04:09:36 damien Exp $");
+RCSID("$Id: auth-passwd.c,v 1.13 1999/12/29 22:48:15 damien Exp $");
 
 #include "packet.h"
 #include "ssh.h"
@@ -43,13 +43,13 @@ auth_password(struct passwd * pw, const char *password)
 	struct spwd *spw;
 #endif
 
+	/* deny if no user. */
+	if (pw == NULL)
+		return 0;
 	if (pw->pw_uid == 0 && options.permit_root_login == 2)
 		return 0;
 	if (*password == '\0' && options.permit_empty_passwd == 0)
 		return 0;
-	/* deny if no user. */
-	if (pw == NULL)
-		return 0;
 
 #ifdef SKEY
 	if (options.skey_authentication == 1) {