diff --git a/CHANGES b/CHANGES
index da71aa3eba889cfb98d7d05f88915e6e32cf618a..8d1294d9f5dffa4024b100640f5a35e1ea5ee06e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,11 +5,15 @@
 
  Changes between 0.9.1c and 0.9.2
 
+  *) Fix reference counting in X509_PUBKEY_get(). This makes
+     demos/maurice/example2.c work, amongst others, probably.
+     [Steve Henson and Ben Laurie]
+
   *) First cut of a cleanup for apps/. First the `ssleay' program is now named
      `openssl' and second, the shortcut symlinks for the `openssl <command>'
      are no longer created. This way we have a single and consistent command
      line interface `openssl <command>', similar to `cvs <command>'.
-     [Ralf S. Engelschall]
+     [Ralf S. Engelschall, Paul Sutton and Ben Laurie]
 
   *) ca.c: move test for DSA keys inside #ifndef NO_DSA. Make pubkey
      BIT STRING wrapper always have zero unused bits.
diff --git a/crypto/asn1/x_pubkey.c b/crypto/asn1/x_pubkey.c
index 200817bf5b33eed1b58569c53716d1f55766ce81..a70f53fe6fe0987996cd61134d2377b5c5cd7260 100644
--- a/crypto/asn1/x_pubkey.c
+++ b/crypto/asn1/x_pubkey.c
@@ -222,7 +222,11 @@ X509_PUBKEY *key;
 
 	if (key == NULL) goto err;
 
-	if (key->pkey != NULL) return(key->pkey);
+	if (key->pkey != NULL)
+	    {
+	    CRYPTO_add(&key->pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
+	    return(key->pkey);
+	    }
 
 	if (key->public_key == NULL) goto err;
 
@@ -252,6 +256,7 @@ X509_PUBKEY *key;
 		}
 #endif
 	key->pkey=ret;
+	CRYPTO_add(&ret->references,1,CRYPTO_LOCK_EVP_PKEY);
 	return(ret);
 err:
 	if (ret != NULL)