diff --git a/CHANGELOG b/CHANGELOG
index cff327e7..97f689c3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -60,10 +60,6 @@ HISTORY
   2009-08-23 Simon Goldschmidt
   * ppp.c: bug #27266: wait-state debug message in pppMain occurs every ms
 
-  2009-08-23 Simon Goldschmidt
-  * udp.c: bug #27252: Address pointer invalid after freeing pbuf in UDP
-    receive callback
-
   2009-08-23 Simon Goldschmidt
   * many ppp files: bug #27267: Added include to string.h where needed
 
diff --git a/src/core/udp.c b/src/core/udp.c
index b884d755..9391c151 100644
--- a/src/core/udp.c
+++ b/src/core/udp.c
@@ -281,10 +281,8 @@ udp_input(struct pbuf *p, struct netif *inp)
       snmp_inc_udpindatagrams();
       /* callback */
       if (pcb->recv != NULL) {
-        /* copy the source address to make it independent of the pbuf */
-        struct ip_addr src_addr = iphdr->src;
         /* now the recv function is responsible for freeing p */
-        pcb->recv(pcb->recv_arg, pcb, p, &src_addr, src);
+        pcb->recv(pcb->recv_arg, pcb, p, &iphdr->src, src);
       } else {
         /* no recv function registered? then we have to free the pbuf! */
         pbuf_free(p);
diff --git a/src/include/lwip/udp.h b/src/include/lwip/udp.h
index d7b2a382..08d1817b 100644
--- a/src/include/lwip/udp.h
+++ b/src/include/lwip/udp.h
@@ -94,6 +94,9 @@ struct udp_pcb {
    * The callback is responsible for freeing the pbuf
    * if it's not used any more.
    *
+   * ATTENTION: Be aware that 'addr' points into the pbuf 'p' so freeing this pbuf
+   *            makes 'addr' invalid, too.
+   *
    * @param arg user supplied argument (udp_pcb.recv_arg)
    * @param pcb the udp_pcb which received data
    * @param p the packet buffer that was received