1 files changed, 5 insertions, 1 deletions

diff --git a/sys/net/zlib.c b/sys/net/zlib.c
index bf1f72dae344..feef531f2b9e 100644
--- a/sys/net/zlib.c
+++ b/sys/net/zlib.c
@@ -3951,11 +3951,15 @@ int r;
           r = Z_MEM_ERROR;
           LEAVE
         }
+	/*
+	 * this ZFREE must occur *BEFORE* we mess with sub.decode, because
+	 * sub.trees is union'd with sub.decode.
+	 */
+        ZFREE(z, s->sub.trees.blens);
         s->sub.decode.codes = c;
         s->sub.decode.tl = tl;
         s->sub.decode.td = td;
       }
-      ZFREE(z, s->sub.trees.blens);
       s->mode = CODES;
     case CODES:
       UPDATE