diff --git a/CHANGELOG b/CHANGELOG
index 6d378498..b76321ea 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -29,7 +29,7 @@ HISTORY
     string, point on one of your's ethernetif field, or alloc a string you will free yourself).
     It will be used by DHCP to register a client hostname, but can also be use when you call
     snmp_set_sysname.
-    
+
   2007-03-28 Frédéric Bernon
   * netif.h, netif.c: A new NETIF_FLAG_ETHARP flag is defined in netif.h, to allow to 
     initialize a network interface's flag with. It tell this interface is an ethernet
@@ -98,6 +98,10 @@ HISTORY
 
   ++ Bug fixes:
 
+  2007-03-28 Frédéric Bernon
+  * api.h, api_lib.c, sockets.c: netbuf_ref doesn't check its internal pbuf_alloc call
+    result and can cause a crash. lwip_send now check netbuf_ref result.
+
   2007-03-28 Simon Goldschmidt
   * sockets.c Remove "#include <errno.h>" from sockets.c to avoid multiple
     definition of macros (in errno.h and lwip/arch.h) if LWIP_PROVIDE_ERRNO is
diff --git a/src/api/api_lib.c b/src/api/api_lib.c
index 128ca288..dc4c2207 100644
--- a/src/api/api_lib.c
+++ b/src/api/api_lib.c
@@ -91,16 +91,21 @@ netbuf_free(struct netbuf *buf)
   buf->p = buf->ptr = NULL;
 }
 
-void
+err_t
 netbuf_ref(struct netbuf *buf, const void *dataptr, u16_t size)
 {
   if (buf->p != NULL) {
     pbuf_free(buf->p);
   }
   buf->p = pbuf_alloc(PBUF_TRANSPORT, 0, PBUF_REF);
+  if (buf->p == NULL) {
+    buf->ptr = NULL;
+    return ERR_MEM;
+  }
   buf->p->payload = (void*)dataptr;
   buf->p->len = buf->p->tot_len = size;
   buf->ptr = buf->p;
+  return ERR_OK;
 }
 
 void
@@ -275,7 +280,7 @@ netconn_delete(struct netconn *conn)
   
   msg.type = API_MSG_DELCONN;
   msg.msg.conn = conn;
-  api_msg_post(&msg);  
+  api_msg_post(&msg);
 
   /* Drain the recvmbox. */
   if (conn->recvmbox != SYS_MBOX_NULL) {
@@ -320,8 +325,7 @@ netconn_type(struct netconn *conn)
 }
 
 err_t
-netconn_peer(struct netconn *conn, struct ip_addr *addr,
-       u16_t *port)
+netconn_peer(struct netconn *conn, struct ip_addr *addr, u16_t *port)
 {
   switch (conn->type) {
   case NETCONN_RAW:
@@ -347,8 +351,7 @@ netconn_peer(struct netconn *conn, struct ip_addr *addr,
 }
 
 err_t
-netconn_addr(struct netconn *conn, struct ip_addr **addr,
-       u16_t *port)
+netconn_addr(struct netconn *conn, struct ip_addr **addr, u16_t *port)
 {
   switch (conn->type) {
   case NETCONN_RAW:
@@ -370,8 +373,7 @@ netconn_addr(struct netconn *conn, struct ip_addr **addr,
 }
 
 err_t
-netconn_bind(struct netconn *conn, struct ip_addr *addr,
-      u16_t port)
+netconn_bind(struct netconn *conn, struct ip_addr *addr, u16_t port)
 {
   struct api_msg msg;
 
@@ -396,8 +398,7 @@ netconn_bind(struct netconn *conn, struct ip_addr *addr,
 
 
 err_t
-netconn_connect(struct netconn *conn, struct ip_addr *addr,
-       u16_t port)
+netconn_connect(struct netconn *conn, struct ip_addr *addr, u16_t port)
 {
   struct api_msg msg;
   
@@ -445,8 +446,7 @@ netconn_listen(struct netconn *conn)
   }
 
   if (conn->acceptmbox == SYS_MBOX_NULL) {
-    conn->acceptmbox = sys_mbox_new();
-    if (conn->acceptmbox == SYS_MBOX_NULL) {
+    if ((conn->acceptmbox = sys_mbox_new()) == SYS_MBOX_NULL) {
       return ERR_MEM;
     }
   }
@@ -657,8 +657,7 @@ netconn_close(struct netconn *conn)
   msg.type = API_MSG_CLOSE;
   msg.msg.conn = conn;
   api_msg_post(&msg);
-  if (conn->err == ERR_MEM &&
-     conn->sem != SYS_SEM_NULL) {
+  if (conn->err == ERR_MEM && conn->sem != SYS_SEM_NULL) {
     sys_sem_wait(conn->sem);
     goto again;
   }
diff --git a/src/api/sockets.c b/src/api/sockets.c
index e549f029..85c9aafe 100644
--- a/src/api/sockets.c
+++ b/src/api/sockets.c
@@ -484,12 +484,11 @@ lwip_send(int s, const void *data, int size, unsigned int flags)
       return -1;
     }
 
-    /* make the buffer point to the data that should
-       be sent */
-    netbuf_ref(buf, data, size);
-
-    /* send the data */
-    err = netconn_send(sock->conn, buf);
+    /* make the buffer point to the data that should be sent */
+    if ((err = netbuf_ref(buf, data, size))==ERR_OK) {
+      /* send the data */
+      err = netconn_send(sock->conn, buf);
+    }
 
     /* deallocated the buffer */
     netbuf_delete(buf);
diff --git a/src/include/lwip/api.h b/src/include/lwip/api.h
index 5472307e..6240910e 100644
--- a/src/include/lwip/api.h
+++ b/src/include/lwip/api.h
@@ -82,7 +82,6 @@ struct netbuf {
   struct pbuf *p, *ptr;
   struct ip_addr *fromaddr;
   u16_t fromport;
-  err_t err;
 };
 
 struct netconn {
@@ -111,7 +110,7 @@ struct netbuf *   netbuf_new      (void);
 void              netbuf_delete   (struct netbuf *buf);
 void *            netbuf_alloc    (struct netbuf *buf, u16_t size);
 void              netbuf_free     (struct netbuf *buf);
-void              netbuf_ref      (struct netbuf *buf,
+err_t             netbuf_ref      (struct netbuf *buf,
            const void *dataptr, u16_t size);
 void              netbuf_chain    (struct netbuf *head,
            struct netbuf *tail);