diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 1c8989c2b..7dfdc0272 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2008-03-02  Christopher Faylor  <me+cygwin@cgf.cx>
+
+	* smallprint.cc (__small_vsprintf): Free allocated buffer rather than
+	pointer into the buffer.
+
 2008-03-01  Christopher Faylor  <me+cygwin@cgf.cx>
 
 	* cygtls.h (_cygtls::handle_threadlist_exception): Eliminate.
diff --git a/winsup/cygwin/smallprint.cc b/winsup/cygwin/smallprint.cc
index a56a340bd..2a7810c50 100644
--- a/winsup/cygwin/smallprint.cc
+++ b/winsup/cygwin/smallprint.cc
@@ -1,6 +1,7 @@
 /* smallprint.cc: small print routines for WIN32
 
-   Copyright 1996, 1998, 2000, 2001, 2002, 2003, 2005, 2006, 2007 Red Hat, Inc.
+   Copyright 1996, 1998, 2000, 2001, 2002, 2003, 2005, 2006, 2007, 2008
+   Red Hat, Inc.
 
 This file is part of Cygwin.
 
@@ -195,17 +196,18 @@ __small_vsprintf (char *dst, const char *fmt, va_list ap)
 		  us = va_arg (ap, PUNICODE_STRING);
 		wfillin:
 		  {
-		    char *tmp;
+		    char *tmpbuf;
 
-		    if (!sys_wcstombs_alloc (&tmp, HEAP_NOTHEAP, us->Buffer,
+		    if (!sys_wcstombs_alloc (&tmpbuf, HEAP_NOTHEAP, us->Buffer,
 					     us->Length / sizeof (WCHAR)))
 		      {
 			s = "invalid UNICODE_STRING";
 			goto fillin;
 		      }
+		    char *tmp = tmpbuf;
 		    for (i = 0; *tmp && i < n; i++)
 		      *dst++ = *tmp++;
-		    free (tmp);
+		    free (tmpbuf);
 		  }
 		  break;
 		default: