Index: lib/ipmi_user.c
===================================================================
RCS file: /cvsroot/ipmitool/ipmitool/lib/ipmi_user.c,v
retrieving revision 1.31
diff -u -r1.31 ipmi_user.c
--- lib/ipmi_user.c	12 Jul 2013 12:35:19 -0000	1.31
+++ lib/ipmi_user.c	12 Jul 2013 13:10:20 -0000
@@ -619,23 +619,28 @@
 #else
 				tmp = (char*)getpass (password_prompt);
 #endif
-				if (tmp != NULL)
+				if (tmp != NULL) {
 					password = strdup(tmp);
+					tmp = NULL;
+				}
 				if (password == NULL) {
 					lprintf(LOG_ERR, "ipmitool: malloc failure");
 					return -1;
 				}
 			}
-			else
-				password = argv[3];
+			else {
+				password = strdup(argv[3]);
+			}
 
 
 			retval = ipmi_user_test_password(intf,
 							 user_id,
 							 password,
 							 password_length == 20);
-
-
+			if (password != NULL) {
+				free(password);
+				password = NULL;
+			}
 		}
 		else
 		{
@@ -664,46 +669,44 @@
 			if (argc == 3)
 			{
 				/* We need to prompt for a password */
-
 				char * tmp;
 				const char * password_prompt =
 					ipmi_user_build_password_prompt(user_id);
-
 #ifdef HAVE_GETPASSPHRASE
 				tmp = getpassphrase (password_prompt);
 #else
 				tmp = (char*)getpass (password_prompt);
 #endif
-				if (tmp != NULL)
-				{
-					password = strdup(tmp);
-					if (password == NULL) {
-						lprintf(LOG_ERR, "ipmitool: malloc failure");
-						return -1;
-					}
-
+				if (tmp == NULL) {
+					lprintf(LOG_ERR, "ipmitool: malloc failure");
+					return (-1);
+				}
+				password = strdup(tmp);
+				tmp = NULL;
+				if (password == NULL) {
+					lprintf(LOG_ERR, "ipmitool: malloc failure");
+					return -1;
+				}
 #ifdef HAVE_GETPASSPHRASE
-					tmp = getpassphrase (password_prompt);
+				tmp = getpassphrase (password_prompt);
 #else
-					tmp = (char*)getpass (password_prompt);
+				tmp = (char*)getpass (password_prompt);
 #endif
-					if (tmp != NULL)
-					{
-						if (strlen(password) != strlen(tmp))
-						{
-							lprintf(LOG_ERR, "Passwords do not match");
-							return -1;
-						}
-						if (strncmp(password, tmp, strlen(tmp)))
-						{
-							lprintf(LOG_ERR, "Passwords to not match");
-							return -1;
-						}
-					}
+				if (tmp == NULL) {
+					lprintf(LOG_ERR, "ipmitool: malloc failure");
+					return (-1);
 				}
+				if (strlen(password) != strlen(tmp)
+						|| strncmp(password, tmp, strlen(tmp))) {
+					lprintf(LOG_ERR, "Passwords do not match.");
+					free(password);
+					password = NULL;
+					return -1;
+				}
+				tmp = NULL;
+			} else {
+				password = strdup(argv[3]);
 			}
-			else
-				password = argv[3];
 
 			if (password == NULL) {
 				lprintf(LOG_ERR, "Unable to parse password argument.");
@@ -720,6 +723,10 @@
 							IPMI_PASSWORD_SET_PASSWORD,
 							password,
 							strlen(password) > 16);
+			if (password != NULL) {
+				free(password);
+				password = NULL;
+			}
 		}
 
 		/*