Fix remaining allocation bugs

2 files changed, 5 insertions, 0 deletions

diff --git a/src/core/surface/call.c b/src/core/surface/call.c
index 84d53c51da..608442c008 100644
--- a/src/core/surface/call.c
+++ b/src/core/surface/call.c
@@ -307,6 +307,9 @@ static void destroy_call(void *call, int ignored_success) {
   for (i = 0; i < GPR_ARRAY_SIZE(c->buffered_metadata); i++) {
     gpr_free(c->buffered_metadata[i].metadata);
   }
+  for (i = 0; i < c->send_initial_metadata_count; i++) {
+    grpc_mdelem_unref(c->send_initial_metadata[i].md);
+  }
   if (c->legacy_state) {
     destroy_legacy_state(c->legacy_state);
   }
@@ -663,6 +666,7 @@ static void enact_send_action(grpc_call *call, send_action sa) {
         grpc_metadata_batch_link_head(&op.data.metadata,
                                       &call->send_initial_metadata[i]);
       }
+      call->send_initial_metadata_count = 0;
       op.done_cb = finish_start_step;
       op.user_data = call;
       op.bind_pollset = grpc_cq_pollset(call->cq);
diff --git a/src/core/surface/lame_client.c b/src/core/surface/lame_client.c
index 710418f1d9..718d9b1fea 100644
--- a/src/core/surface/lame_client.c
+++ b/src/core/surface/lame_client.c
@@ -52,6 +52,7 @@ static void call_op(grpc_call_element *elem, grpc_call_element *from_elem,
 
   switch (op->type) {
     case GRPC_SEND_METADATA:
+      grpc_metadata_batch_destroy(&op->data.metadata);
       grpc_call_recv_synthetic_status(elem, GRPC_STATUS_UNKNOWN, "Rpc sent on a lame channel.");
       grpc_call_stream_closed(elem);
       break;