coverity: read from pointer after free