Fix allocation bugs in server shutdown.

2 files changed, 6 insertions, 7 deletions

diff --git a/src/core/ext/transport/chttp2/server/chttp2_server.c b/src/core/ext/transport/chttp2/server/chttp2_server.c
index 50cbafab56..dc85d1cf5c 100644
--- a/src/core/ext/transport/chttp2/server/chttp2_server.c
+++ b/src/core/ext/transport/chttp2/server/chttp2_server.c
@@ -338,11 +338,12 @@ error:
   }
   if (tcp_server) {
     grpc_tcp_server_unref(exec_ctx, tcp_server);
+  } else {
+    grpc_channel_args_destroy(state->args);
+    grpc_chttp2_server_handshaker_factory_destroy(exec_ctx,
+                                                  state->handshaker_factory);
+    gpr_free(state);
   }
-  grpc_channel_args_destroy(state->args);
-  grpc_chttp2_server_handshaker_factory_destroy(exec_ctx,
-                                                state->handshaker_factory);
-  gpr_free(state);
   *port_num = 0;
 
 done:
diff --git a/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c b/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c
index b9a833803b..5f41728132 100644
--- a/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c
+++ b/src/core/ext/transport/chttp2/server/secure/server_secure_chttp2.c
@@ -69,6 +69,7 @@ static void server_security_handshaker_factory_destroy(
       (server_security_handshaker_factory *)hf;
   GRPC_SECURITY_CONNECTOR_UNREF(&handshaker_factory->security_connector->base,
                                 "server");
+  gpr_free(hf);
 }
 
 static const grpc_chttp2_server_handshaker_factory_vtable
@@ -124,9 +125,6 @@ done:
     gpr_log(GPR_ERROR, "%s", msg);
     grpc_error_free_string(msg);
     GRPC_ERROR_UNREF(err);
-    if (sc != NULL) {
-      GRPC_SECURITY_CONNECTOR_UNREF(&sc->base, "server");
-    }
   }
   return port_num;
 }