diff --git a/common/sphinx.c b/common/sphinx.c
index 4fc0bdab4..b39106f90 100644
--- a/common/sphinx.c
+++ b/common/sphinx.c
@@ -355,8 +355,11 @@ struct onionpacket *create_onionpacket(
 	struct hop_params *params = generate_hop_params(ctx, sessionkey, path);
 	struct secret *secrets = tal_arr(ctx, struct secret, num_hops);
 
-	if (!params)
+	if (!params) {
+		tal_free(packet);
+		tal_free(secrets);
 		return NULL;
+	}
 	packet->version = 0;
 	memset(nexthmac, 0, SECURITY_PARAMETER);
 	memset(packet->routinginfo, 0, ROUTING_INFO_SIZE);
diff --git a/lightningd/pay.c b/lightningd/pay.c
index 2cdab2113..6a47d6f50 100644
--- a/lightningd/pay.c
+++ b/lightningd/pay.c
@@ -231,9 +231,10 @@ static bool send_payment(struct command *cmd,
 				    sizeof(struct sha256), &path_secrets);
 	onion = serialize_onionpacket(cmd, packet);
 
-	if (pc)
+	if (pc) {
 		pc->ids = tal_free(pc->ids);
-	else {
+		pc->path_secrets = tal_free(pc->path_secrets);
+	} else {
 		pc = tal(cmd->ld, struct pay_command);
 		list_add_tail(&cmd->ld->pay_commands, &pc->list);
 		tal_add_destructor(pc, pay_command_destroyed);