diff --git a/src/frontend/variable.c b/src/frontend/variable.c
index 6ba60eee4..da777c572 100644
--- a/src/frontend/variable.c
+++ b/src/frontend/variable.c
@@ -718,13 +718,15 @@ cp_variablesubst(wordlist *wlist)
 wordlist *
 vareval(char *string)
 {
-    struct variable *v;
+    struct variable *v, *vfree = NULL;
     wordlist *wl;
     char buf[BSIZE_SP], *s;
     char *oldstring = copy(string);
     char *range = NULL;
     int i, up, low;
 
+    /* usage of vfree: variable v has to be freed only if created by cp_enqvar()! */
+
     cp_wstrip(string);
     if ((s = strchr(string, '[')) != NULL) {
         *s = '\0';
@@ -760,8 +762,9 @@ vareval(char *string)
             if (eq(v->va_name, string))
                 break;
         if (!v)
-            v = cp_enqvar(string);
+            vfree = v = cp_enqvar(string);
         wl = wl_cons(copy(v ? "1" : "0"), NULL);
+        free_struct_variable(vfree);
         tfree(oldstring);
         return (wl);
 
@@ -771,7 +774,7 @@ vareval(char *string)
             if (eq(v->va_name, string))
                 break;
         if (!v)
-            v = cp_enqvar(string);
+            vfree = v = cp_enqvar(string);
         if (!v) {
             fprintf(cp_err, "Error: %s: no such variable.\n", string);
             tfree(oldstring);
@@ -784,6 +787,7 @@ vareval(char *string)
             i = (v->va_type != CP_BOOL);
         wl = wl_cons(tprintf("%d", i), NULL);
         tfree(oldstring);
+        free_struct_variable(vfree);
         return (wl);
 
     case '\0':
@@ -792,6 +796,7 @@ vareval(char *string)
         return (wl);
     }
 
+    vfree = NULL; //just in case ...
     /* The notation var[stuff] has two meanings...  If this is a real
      * variable, then the [] denotes range, but if this is a strange
      * (e.g, device parameter) variable, it could be anything...
@@ -808,7 +813,7 @@ vareval(char *string)
     if (!v) {
         range = NULL;
         string = oldstring;
-        v = cp_enqvar(string);
+        vfree = v = cp_enqvar(string);
     }
     if (!v && (s = getenv(string)) != NULL) {
         wl = wl_cons(copy(s), NULL);
@@ -821,6 +826,7 @@ vareval(char *string)
         return (NULL);
     }
     wl = cp_varwl(v);
+    free_struct_variable(vfree);
 
     /* Now parse and deal with 'range' ... */
     if (range) {