diff --git a/crypto/dist/ipsec-tools/src/racoon/cfparse.y b/crypto/dist/ipsec-tools/src/racoon/cfparse.y
index 27f9fc5bf247..b19382677f73 100644
--- a/crypto/dist/ipsec-tools/src/racoon/cfparse.y
+++ b/crypto/dist/ipsec-tools/src/racoon/cfparse.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: cfparse.y,v 1.39 2011/03/01 14:14:50 vanhu Exp $	*/
+/*	$NetBSD: cfparse.y,v 1.40 2011/03/02 14:49:21 vanhu Exp $	*/
 
 /* Id: cfparse.y,v 1.66 2006/08/22 18:17:17 manubsd Exp */
 
@@ -423,13 +423,16 @@ listen_stmt
 	:	X_ISAKMP ike_addrinfo_port
 		{
 			myaddr_listen($2, FALSE);
+			racoon_free($2);
 		}
 		EOS
 	|	X_ISAKMP_NATT ike_addrinfo_port
 		{
 #ifdef ENABLE_NATT
 			myaddr_listen($2, TRUE);
+			racoon_free($2);
 #else
+			racoon_free($2);
 			yyerror("NAT-T support not compiled in.");
 #endif
 		}
diff --git a/crypto/dist/ipsec-tools/src/racoon/prsa_par.y b/crypto/dist/ipsec-tools/src/racoon/prsa_par.y
index 5d4c6fb580cb..1987e4d4fbd0 100644
--- a/crypto/dist/ipsec-tools/src/racoon/prsa_par.y
+++ b/crypto/dist/ipsec-tools/src/racoon/prsa_par.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: prsa_par.y,v 1.5 2011/02/10 11:17:17 tteras Exp $	*/
+/*	$NetBSD: prsa_par.y,v 1.6 2011/03/02 14:49:21 vanhu Exp $	*/
 
 /* Id: prsa_par.y,v 1.3 2004/11/08 12:04:23 ludvigm Exp */
 
@@ -211,6 +211,7 @@ rsa_statement:
 			YYABORT;
 		}
 		$$ = base64_pubkey2rsa($2);
+		free($2);
 	}
 	| TAG_PUB HEX
 	{
@@ -256,6 +257,7 @@ addr4:
 		}
 		memcpy(sap, res->ai_addr, res->ai_addrlen);
 		freeaddrinfo(res);
+		free($1);
 	}
 	;
 
@@ -284,6 +286,7 @@ addr6:
 		}
 		memcpy(sap, res->ai_addr, res->ai_addrlen);
 		freeaddrinfo(res);
+		free($1);
 	}
 	;