diff --git a/CHANGES b/CHANGES
index de150ba18e..feb11cbd46 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,15 @@
 
                                   Changelog
 
+Daniel Stenberg (12 Feb 2010)
+- Jack Zhang reported a problem with SMTP: we wrongly used multiple addresses
+  in the same RCPT TO line, when they should be sent in separate single
+  commands. I updated test case 802 to verify this.
+
+- I also fixed a bad use of my_setopt_str() of CURLOPT_MAIL_RCPT in the curl
+  tool which made it try to output it as string for the --libcurl feature
+  which could lead to crashes.
+
 Yang Tse (11 Feb 2010)
 - Steven M. Schweda fixed VMS builder bad behavior when used in a batch job,
   removed obsolete batch_compile.com and defines.com and updated VMS readme.
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 3a1f9e33e9..6a8458e232 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -14,6 +14,7 @@ This release includes the following changes:
 This release includes the following bugfixes:
 
  o VMS builder bad behavior when used in a batch job
+ o multiple recepients with SMTP
 
 This release includes the following known bugs:
 
@@ -22,6 +23,6 @@ This release includes the following known bugs:
 This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
- Steven M. Schweda
+ Steven M. Schweda, Yang Tse, Jack Zhang
 
         Thanks! (and sorry if I forgot to mention someone)
diff --git a/lib/smtp.c b/lib/smtp.c
index 1e53047239..7e3d4670c1 100644
--- a/lib/smtp.c
+++ b/lib/smtp.c
@@ -344,27 +344,18 @@ static CURLcode smtp_state_mail_resp(struct connectdata *conn,
     state(conn, SMTP_STOP);
   }
   else {
+    struct smtp_conn *smtpc = &conn->proto.smtpc;
+
     /* send RCPT TO */
-    struct curl_slist *rcpt;
-    char *buffer = NULL;
+    smtpc->rcpt = data->set.mail_rcpt;
 
-    for(rcpt = data->set.mail_rcpt; rcpt; rcpt=rcpt->next) {
-      char *add = aprintf("%s%s%s", buffer?buffer:"", buffer?", ":"",
-                          rcpt->data);
-      if(!add) {
-        free(buffer);
-        return CURLE_OUT_OF_MEMORY;
-      }
-      buffer = add;
+    if(smtpc->rcpt) {
+      result = Curl_pp_sendf(&conn->proto.smtpc.pp, "RCPT TO:%s",
+                             smtpc->rcpt->data);
+      if(result)
+        return result;
     }
 
-    result = Curl_pp_sendf(&conn->proto.smtpc.pp, "RCPT TO:%s", buffer);
-
-    free(buffer);
-
-    if(result)
-      return result;
-
     state(conn, SMTP_RCPT);
   }
   return result;
@@ -385,6 +376,20 @@ static CURLcode smtp_state_rcpt_resp(struct connectdata *conn,
     state(conn, SMTP_STOP);
   }
   else {
+    struct smtp_conn *smtpc = &conn->proto.smtpc;
+
+    /* one RCPT is done, but if there's one more to send go on */
+    smtpc->rcpt = smtpc->rcpt->next;
+    if(smtpc->rcpt) {
+      result = Curl_pp_sendf(&conn->proto.smtpc.pp, "RCPT TO:%s",
+                             smtpc->rcpt->data);
+      if(result)
+        return result;
+
+      state(conn, SMTP_RCPT);
+      return CURLE_OK;
+    }
+
     /* send DATA */
     result = Curl_pp_sendf(&conn->proto.smtpc.pp, "DATA", "");
     if(result)
diff --git a/lib/smtp.h b/lib/smtp.h
index a1115e23a1..cc581d4d58 100644
--- a/lib/smtp.h
+++ b/lib/smtp.h
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 2009, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 2009 - 2010, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -49,6 +49,7 @@ struct smtp_conn {
   int eob;         /* number of bytes of the EOB (End Of Body) that has been
                       received thus far */
   smtpstate state; /* always use smtp.c:state() to change state! */
+  struct curl_slist *rcpt;
 };
 
 extern const struct Curl_handler Curl_handler_smtp;
diff --git a/tests/data/test802 b/tests/data/test802
index dedc1e1fd9..d3114137d7 100644
--- a/tests/data/test802
+++ b/tests/data/test802
@@ -26,7 +26,7 @@ To: another
 body
 </stdin>
  <command>
-smtp://%HOSTIP:%SMTPPORT/user --mail-rcpt 802@foo --mail-from 802@from -T -
+smtp://%HOSTIP:%SMTPPORT/user --mail-rcpt 802@foo --mail-rcpt 802@foobar.example --mail-from 802@from -T -
 </command>
 </client>
 
@@ -37,6 +37,7 @@ smtp://%HOSTIP:%SMTPPORT/user --mail-rcpt 802@foo --mail-from 802@from -T -
 EHLO user
 MAIL FROM:802@from
 RCPT TO:802@foo
+RCPT TO:802@foobar.example
 DATA
 QUIT
 </protocol>