Index: head/sbin/dhclient/parse.c
===================================================================
--- head/sbin/dhclient/parse.c
+++ head/sbin/dhclient/parse.c
@@ -131,8 +131,10 @@
 		error("no memory for string %s.", val);
 	memcpy(s, val, valsize);
 
-	if (!parse_semi(cfile))
+	if (!parse_semi(cfile)) {
+		free(s);
 		return (NULL);
+	}
 	return (s);
 }
 
@@ -246,9 +248,10 @@
 	char *val, *t;
 	size_t valsize;
 	pair c = NULL;
+	unsigned char *lbufp = NULL;
 
 	if (!bufp && *max) {
-		bufp = malloc(*max * size / 8);
+		lbufp = bufp = malloc(*max * size / 8);
 		if (!bufp)
 			error("can't allocate space for numeric aggregate");
 	} else
@@ -265,6 +268,7 @@
 				parse_warn("too few numbers.");
 				if (token != SEMI)
 					skip_to_semi(cfile);
+				free(lbufp);
 				return (NULL);
 			}
 			token = next_token(&val, cfile);
@@ -281,6 +285,7 @@
 		    (base != 16 || token != NUMBER_OR_NAME)) {
 			parse_warn("expecting numeric value.");
 			skip_to_semi(cfile);
+			free(lbufp);
 			return (NULL);
 		}
 		/*
@@ -302,6 +307,7 @@
 
 	/* If we had to cons up a list, convert it now. */
 	if (c) {
+		free(lbufp);
 		bufp = malloc(count * size / 8);
 		if (!bufp)
 			error("can't allocate space for numeric aggregate.");