diff --git a/src/acl.c b/src/acl.c
index 318cb51..209580a 100644
--- a/src/acl.c
+++ b/src/acl.c
@@ -342,6 +342,8 @@
 				goto out_free_smp;
 			}
 		}
+		free(ckw);
+		ckw = NULL;
 	}
 	else {
 		/* This is not an ACL keyword, so we hope this is a sample fetch
@@ -360,7 +362,7 @@
 	expr = calloc(1, sizeof(*expr));
 	if (!expr) {
 		memprintf(err, "out of memory when parsing ACL expression");
-		goto out_return;
+		goto out_free_smp;
 	}
 
 	pattern_init_head(&expr->pat);
@@ -678,8 +680,8 @@
  out_free_expr:
 	prune_acl_expr(expr);
 	free(expr);
-	free(ckw);
  out_free_smp:
+	free(ckw);
 	free(smp);
  out_return:
 	return NULL;