2 files changed, 11 insertions, 4 deletions

diff --git a/lib/libusb/libusb10.c b/lib/libusb/libusb10.c
index 5767cb22d3b0..3b8d567dae9b 100644
--- a/lib/libusb/libusb10.c
+++ b/lib/libusb/libusb10.c
@@ -800,6 +800,10 @@ libusb_free_transfer(struct libusb_transfer *uxfer)
 	if (uxfer == NULL)
 		return;			/* be NULL safe */
 
+	/* check if we should free the transfer buffer */
+	if (uxfer->flags & LIBUSB_TRANSFER_FREE_BUFFER)
+		free(uxfer->buffer);
+
 	sxfer = (struct libusb_super_transfer *)(
 	    (uint8_t *)uxfer - sizeof(*sxfer));
 
diff --git a/lib/libusb/libusb10_io.c b/lib/libusb/libusb10_io.c
index 48405c9f2379..380e312bf6b6 100644
--- a/lib/libusb/libusb10_io.c
+++ b/lib/libusb/libusb10_io.c
@@ -187,6 +187,8 @@ do_done:
 	/* Do all done callbacks */
 
 	while ((sxfer = TAILQ_FIRST(&ctx->tr_done))) {
+		uint8_t flags;
+
 		TAILQ_REMOVE(&ctx->tr_done, sxfer, entry);
 		sxfer->entry.tqe_prev = NULL;
 
@@ -197,13 +199,14 @@ do_done:
 		uxfer = (struct libusb_transfer *)(
 		    ((uint8_t *)sxfer) + sizeof(*sxfer));
 
+		/* Allow the callback to free the transfer itself. */
+		flags = uxfer->flags;
+
 		if (uxfer->callback != NULL)
 			(uxfer->callback) (uxfer);
 
-		if (uxfer->flags & LIBUSB_TRANSFER_FREE_BUFFER)
-			free(uxfer->buffer);
-
-		if (uxfer->flags & LIBUSB_TRANSFER_FREE_TRANSFER)
+		/* Check if the USB transfer should be automatically freed. */
+		if (flags & LIBUSB_TRANSFER_FREE_TRANSFER)
 			libusb_free_transfer(uxfer);
 
 		CTX_LOCK(ctx);