diff --git a/runopts.h b/runopts.h
index 50c51dfbe..90b809c8b 100644
--- a/runopts.h
+++ b/runopts.h
@@ -128,8 +128,10 @@ typedef struct svr_runopts {
 	char * forced_command;
 
 #if DROPBEAR_PLUGIN 
-        char *pubkey_plugin;
-        char *pubkey_plugin_options;
+	/* malloced */
+	char *pubkey_plugin;
+	/* points into pubkey_plugin */
+	char *pubkey_plugin_options;
 #endif
 
 	int pass_on_env;
diff --git a/svr-runopts.c b/svr-runopts.c
index c15f23b77..f2e8b89be 100644
--- a/svr-runopts.c
+++ b/svr-runopts.c
@@ -448,15 +448,15 @@ void svr_getopts(int argc, char ** argv) {
 #endif
 
 #if DROPBEAR_PLUGIN
-        if (pubkey_plugin) {
-            char *args = strchr(pubkey_plugin, ',');
-            if (args) {
-                *args='\0';
-                ++args;
-            }
-            svr_opts.pubkey_plugin = pubkey_plugin;
-            svr_opts.pubkey_plugin_options = args;
-        }
+	if (pubkey_plugin) {
+		svr_opts.pubkey_plugin = m_strdup(pubkey_plugin);
+		char *args = strchr(svr_opts.pubkey_plugin, ',');
+		if (args) {
+			*args='\0';
+			++args;
+		}
+		svr_opts.pubkey_plugin_options = args;
+	}
 #endif
 }
 
diff --git a/svr-session.c b/svr-session.c
index dac7de2bf..769f0731d 100644
--- a/svr-session.c
+++ b/svr-session.c
@@ -208,7 +208,7 @@ void svr_session(int sock, int childpipe) {
 
 }
 
-/* failure exit - format must be <= 100 chars */
+/* cleanup and exit - format must be <= 100 chars */
 void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
 	char exitmsg[150];
 	char fullmsg[300];
@@ -217,10 +217,12 @@ void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
 	int add_delay = 0;
 
 #if DROPBEAR_PLUGIN
-        if ((ses.plugin_session != NULL)) {
-            svr_ses.plugin_instance->delete_session(ses.plugin_session);
-        }
-        ses.plugin_session = NULL;
+	if ((ses.plugin_session != NULL)) {
+		svr_ses.plugin_instance->delete_session(ses.plugin_session);
+	}
+	ses.plugin_session = NULL;
+	svr_opts.pubkey_plugin_options = NULL;
+	m_free(svr_opts.pubkey_plugin);
 #endif
 
 	/* Render the formatted exit message */