diff --git a/ChangeLog b/ChangeLog
index 61c9a1fb9..ad959980c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,9 @@
    - deraadt@cvs.openbsd.org 2002/06/26 15:00:32
      [monitor_wrap.c]
      more %u
+   - markus@cvs.openbsd.org 2002/06/26 22:27:32
+     [ssh-keysign.c]
+     bug #304, xfree(data) called to early; openssh@sigint.cs.purdue.edu
 
 20020626
  - (stevesk) [monitor.c] remove duplicate proto15 dispatch entry for PAM
@@ -1184,4 +1187,4 @@
  - (stevesk) entropy.c: typo in debug message
  - (djm) ssh-keygen -i needs seeded RNG; report from markus@
 
-$Id: ChangeLog,v 1.2306 2002/06/27 00:23:02 mouring Exp $
+$Id: ChangeLog,v 1.2307 2002/06/27 00:25:07 mouring Exp $
diff --git a/ssh-keysign.c b/ssh-keysign.c
index 7f1d25d8c..6a435684b 100644
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keysign.c,v 1.4 2002/06/19 00:27:55 deraadt Exp $");
+RCSID("$OpenBSD: ssh-keysign.c,v 1.5 2002/06/26 22:27:32 markus Exp $");
 
 #include <openssl/evp.h>
 
@@ -192,7 +192,6 @@ main(int argc, char **argv)
 	data = buffer_get_string(&b, &dlen);
 	if (valid_request(pw, host, &key, data, dlen) < 0)
 		fatal("not a valid request");
-	xfree(data);
 	xfree(host);
 
 	found = 0;
@@ -208,6 +207,7 @@ main(int argc, char **argv)
 
 	if (key_sign(keys[i], &signature, &slen, data, dlen) != 0)
 		fatal("key_sign failed");
+	xfree(data);
 
 	/* send reply */
 	buffer_clear(&b);