diff --git a/lib/krb5/init_creds_pw.c b/lib/krb5/init_creds_pw.c
index 990b395d0..efef8725c 100644
--- a/lib/krb5/init_creds_pw.c
+++ b/lib/krb5/init_creds_pw.c
@@ -79,8 +79,10 @@ default_s2k_func(krb5_context context, krb5_enctype type,
 	return ENOMEM;
     ret = krb5_string_to_key_data_salt_opaque(context, type, password,
 					      salt, opaque, *key);
-    if (ret)
+    if (ret) {
 	free(*key);
+	*key = NULL;
+    }
     return ret;
 }