Fix use after free in IPReassembler