diff --git a/libfreerdp/core/gateway/tsg.c b/libfreerdp/core/gateway/tsg.c
index f23f90306..5a1fb8a87 100644
--- a/libfreerdp/core/gateway/tsg.c
+++ b/libfreerdp/core/gateway/tsg.c
@@ -231,7 +231,10 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 		packetCapsResponse = (PTSG_PACKET_CAPS_RESPONSE) calloc(1, sizeof(TSG_PACKET_CAPS_RESPONSE));
 
 		if (!packetCapsResponse) // TODO: correct cleanup
+		{
+			free(packet);
 			return FALSE;
+		}
 
 		packet->tsgPacket.packetCapsResponse = packetCapsResponse;
 		/* PacketQuarResponsePtr (4 bytes) */
@@ -280,7 +283,11 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 		versionCaps = (PTSG_PACKET_VERSIONCAPS) calloc(1, sizeof(TSG_PACKET_VERSIONCAPS));
 
 		if (!versionCaps) // TODO: correct cleanup
+		{
+			free(packetCapsResponse);
+			free(packet);
 			return FALSE;
+		}
 
 		packetCapsResponse->pktQuarEncResponse.versionCaps = versionCaps;
 		versionCaps->tsgHeader.ComponentId = *((UINT16*) &buffer[offset]); /* ComponentId */
@@ -308,7 +315,12 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 		tsgCaps = (PTSG_PACKET_CAPABILITIES) calloc(1, sizeof(TSG_PACKET_CAPABILITIES));
 
 		if (!tsgCaps)
+		{
+			free(packetCapsResponse);
+			free(versionCaps);
+			free(packet);
 			return FALSE;
+		}
 
 		versionCaps->tsgCaps = tsgCaps;
 		offset += 4; /* MaxCount (4 bytes) */