diff --git a/ospfd/ChangeLog b/ospfd/ChangeLog
index 7b77cb4..751f5d3 100644
--- a/ospfd/ChangeLog
+++ b/ospfd/ChangeLog
@@ -1,3 +1,10 @@
+2005-11-11 Paul Jakma <paul.jakma@sun.com>
+
+	* ospf_spf.c: (ospf_canonical_nexthops_free) Free only
+	  the nexthops pointing to the root vertex. We may visit a
+	  vertex twice or the vertex may have some inherited nexthops,
+	  if we free other nexthops we could crash.
+ 
 2005-11-04 Paul Jakma <paul.jakma@sun.com>
 
 	* ospf_{dump,spf,vty}.c: Oops, use the internal tv_sub
diff --git a/ospfd/ospf_spf.c b/ospfd/ospf_spf.c
index 564ae84..dbd0636 100644
--- a/ospfd/ospf_spf.c
+++ b/ospfd/ospf_spf.c
@@ -94,11 +94,20 @@
       struct listnode *n2, *nn2;
       struct vertex_parent *vp;
       
+      /* router vertices through an attached network each
+       * have a distinct (canonical / not inherited) nexthop
+       * which must be freed.
+       *
+       * A network vertex can only have router vertices as its
+       * children, so only one level of recursion is possible.
+       */
       if (child->type == OSPF_VERTEX_NETWORK)
         ospf_canonical_nexthops_free (child);
       
+      /* Free child nexthops pointing back to this root vertex */
       for (ALL_LIST_ELEMENTS (child->parents, n2, nn2, vp))
-        vertex_nexthop_free (vp->nexthop);
+        if (vp->parent == root)
+          vertex_nexthop_free (vp->nexthop);
     }
 }