diff --git a/doc/Changelog b/doc/Changelog
index 2614724aa..287a583f8 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+3 June 2009: Wouter
+	- fixup bad free() when wrongly encoded DSA signature is seen.
+	  Reported by Paul Wouters.
+
 2 June 2009: Wouter
 	- --enable-sha2 option. The draft rsasha256 changed its algorithm
 	  numbers too often.  Therefore it is more prudent to disable the
diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 0d2ebf413..3f5e47433 100644
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -1193,7 +1193,7 @@ setup_dsa_sig(unsigned char** sig, unsigned int* len)
 	*sig = NULL;
 	newlen = i2d_DSA_SIG(dsasig, sig);
 	if(newlen < 0) {
-		free(sig);
+		free(*sig);
 		return 0;
 	}
 	*len = (unsigned int)newlen;