fixed use after free