diff --git a/ChangeLog b/ChangeLog
index bd16745c..721ec028 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,9 @@ v0.35.05	19-Oct-2002
 		There is now a mberrors.h file that defines all errorcodes
 		returned by all programs.
 
+	mbcico:
+		Fixed crash with incoming YooHoo session with bad password.
+
 
 
 v0.35.04	29-Sep-2002 - 19-Oct-2002.
diff --git a/mbcico/yoohoo.c b/mbcico/yoohoo.c
index 63d57717..89e6847f 100644
--- a/mbcico/yoohoo.c
+++ b/mbcico/yoohoo.c
@@ -179,7 +179,9 @@ int rx_yoohoo(void)
 		inbound = xstrcpy(CFG.pinbound);
 		pwd = xstrcpy(nodes.Spasswd);
 	    } else {
-		pwd = (char *)"BAD_PASS";
+		if (pwd)
+		    free(pwd);
+		pwd = xstrcpy((char *)"BAD_PASS");
 		Syslog('?', "Remote password \"%s\", expected \"%s\"", (char*)hello2.my_password, nodes.Spasswd);
 		localcaps = 0;
 	    }
@@ -187,7 +189,7 @@ int rx_yoohoo(void)
 	    Syslog('s', "No YooHoo password check");
 	
 	fillhello(localcaps,pwd);
-
+	
 	rc = txyoohoo();
 	if (pwd)
 	    free(pwd);