2 files changed, 4 insertions, 5 deletions
diff --git a/epan/dissectors/packet-umts_mac.c b/epan/dissectors/packet-umts_mac.c
index e4128f9c1e..d18b5d8667 100644
--- a/epan/dissectors/packet-umts_mac.c
+++ b/epan/dissectors/packet-umts_mac.c
@@ -681,7 +681,7 @@ static void init_frag(tvbuff_t * tvb, body_parts * bp, guint length, guint offse
     mac_is_fragment * frag = wmem_new(wmem_file_scope(), mac_is_fragment);
     frag->type = type;
     frag->length = length;
-    frag->data = (guint8 *)g_malloc(length);
+    frag->data = (guint8 *)wmem_alloc(wmem_file_scope(), length);
     frag->frame_num = frame_num;
     frag->tsn = tsn;
     frag->next = NULL;
@@ -711,7 +711,7 @@ static void mac_is_copy(mac_is_sdu * sdu, mac_is_fragment * frag, guint total_le
         memcpy(sdu->data+sdu->length, frag->data, frag->length);
     }
     sdu->length += frag->length;
-    g_free(frag->data);
+    wmem_free(wmem_file_scope(), frag->data);
 }
 
 /*
diff --git a/epan/dissectors/packet-umts_rlc.c b/epan/dissectors/packet-umts_rlc.c
index fec5c31445..a89c524379 100644
--- a/epan/dissectors/packet-umts_rlc.c
+++ b/epan/dissectors/packet-umts_rlc.c
@@ -470,8 +470,7 @@ rlc_frag_assign_data(struct rlc_frag *frag, tvbuff_t *tvb,
              guint16 offset, guint16 length)
 {
     frag->len  = length;
-    frag->data = (guint8 *)g_malloc(length);
-    tvb_memcpy(tvb, frag->data, offset, length);
+    frag->data = (guint8 *)tvb_memdup(wmem_file_scope(), tvb, offset, length);
     return 0;
 }
 
@@ -848,7 +847,7 @@ reassemble_data(struct rlc_channel *ch, struct rlc_sdu *sdu, struct rlc_frag *fr
     temp = sdu->frags;
     while (temp && ((offs + temp->len) <= sdu->len)) {
         memcpy(sdu->data + offs, temp->data, temp->len);
-        g_free(temp->data);
+        wmem_free(wmem_file_scope(), temp->data);
         temp->data = NULL;
         /* mark this fragment in reassembled table */
         g_hash_table_insert(reassembled_table, temp, sdu);