diff --git a/server/token.c b/server/token.c
index a0df935638..aedba6a494 100644
--- a/server/token.c
+++ b/server/token.c
@@ -1031,6 +1031,12 @@ DECL_HANDLER(duplicate_token)
             {
                 size_t size = FIELD_OFFSET( struct sid_and_attributes, sid.SubAuthority[group->sid.SubAuthorityCount] );
                 struct sid_and_attributes *newgroup = mem_alloc( size );
+                if (!newgroup)
+                {
+                    release_object( token );
+                    release_object( src_token );
+                    return;
+                }
                 memcpy( newgroup, group, size );
                 list_add_tail( &token->groups, &newgroup->entry );
             }