diff --git a/CHANGES b/CHANGES
index de31616dd6..0dceb8a5a3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2435.	[bug]		Fixed an ACL memory leak affecting win32.
+
 2433.	[tuning]	Set initial timeout to 800ms.
 
 2431.	[bug]		Acl processing could leak memory. [RT #18323]
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index bb54a8a319..a63ecdb031 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acl.c,v 1.37.2.7 2008/04/29 01:04:14 each Exp $ */
+/* $Id: acl.c,v 1.37.2.8 2008/09/10 21:54:08 each Exp $ */
 
 /*! \file */
 
@@ -234,8 +234,10 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 		dns_aclelement_t *e = &acl->elements[i];
 
 		/* Already found a better match? */
-		if (match_num != -1 && match_num < e->node_num)
+		if (match_num != -1 && match_num < e->node_num) {
+			isc_refcount_destroy(&pfx.refcount);
 			return (ISC_R_SUCCESS);
+		}
 
 		if (dns_aclelement_match(reqaddr, reqsigner,
 					 e, env, matchelt)) {
@@ -245,10 +247,12 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 				else
 					*match = e->node_num;
 			}
+			isc_refcount_destroy(&pfx.refcount);
 			return (ISC_R_SUCCESS);
 		}
 	}
 
+	isc_refcount_destroy(&pfx.refcount);
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/iptable.c b/lib/dns/iptable.c
index 2183551eb9..11d3d8ed38 100644
--- a/lib/dns/iptable.c
+++ b/lib/dns/iptable.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: iptable.c,v 1.5.46.4 2008/08/27 04:53:58 marka Exp $ */
+/* $Id: iptable.c,v 1.5.46.5 2008/09/10 21:54:08 each Exp $ */
 
 #include <isc/mem.h>
 #include <isc/radix.h>
@@ -75,8 +75,10 @@ dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
 
 	result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
 
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		isc_refcount_destroy(&pfx.refcount);
 		return(result);
+	}
 
 	/* If the node already contains data, don't overwrite it */
 	if (node->data[ISC_IS6(family)] == NULL) {
@@ -86,6 +88,7 @@ dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
 			node->data[ISC_IS6(family)] = &dns_iptable_neg;
 	}
 
+	isc_refcount_destroy(&pfx.refcount);
 	return (ISC_R_SUCCESS);
 }