If an Option is already defined at top-level in ssh_config, ssh(1) skips overriding the 
option in Host block.

Author: Ashish SHUKLA <gmail.com!wahjava>
--- readconf.c.orig	2010-08-21 06:30:20.000000000 +0530
+++ readconf.c	2010-08-21 06:51:57.000000000 +0530
@@ -592,8 +592,11 @@
 		arg = strdelim(&s);
 		if (!arg || *arg == '\0')
 			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (*activep && *charptr == NULL)
+		if (*activep) {
+			if (*charptr)
+				xfree(*charptr);
 			*charptr = xstrdup(arg);
+		}
 		break;
 
 	case oGlobalKnownHostsFile:
--- ssh.c.orig	2010-08-21 07:33:56.000000000 +0530
+++ ssh.c	2010-08-21 07:38:39.000000000 +0530
@@ -484,7 +484,7 @@
 			}
 			break;
 		case 'l':
-			options.user = optarg;
+			options.user = xstrdup(optarg);
 			break;
 
 		case 'L':
@@ -547,7 +547,7 @@
 			options.control_path = xstrdup(optarg);
 			break;
 		case 'b':
-			options.bind_address = optarg;
+			options.bind_address = xstrdup(optarg);
 			break;
 		case 'F':
 			config = optarg;
