diff --git a/lib/url.c b/lib/url.c
index 9fd1ce5762c1d69c64606090b5ea12bd32993621..76331aac9a716aecb01f2e462c6a6b96b223d0c3 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2290,15 +2290,13 @@ static CURLcode CreateConnection(struct SessionHandle *data,
                                  "%" MAX_CURL_PASSWORD_LENGTH_TXT "[^@]",
                                  user, passwd))) {
             /* found user and password, rip them out */
-            if(conn->proxyuser)
-              free(conn->proxyuser);
+            Curl_safefree(conn->proxyuser);
             conn->proxyuser = strdup(user);
 
             if(!conn->proxyuser)
               return CURLE_OUT_OF_MEMORY;
             
-            if(conn->proxypasswd)
-              free(conn->proxypasswd);
+            Curl_safefree(conn->proxypasswd);
             conn->proxypasswd = strdup(passwd);
 
             if(!conn->proxypasswd)
@@ -2882,8 +2880,8 @@ static CURLcode CreateConnection(struct SessionHandle *data,
 
     free(old_conn->user);
     free(old_conn->passwd);
-    free(old_conn->proxyuser);
-    free(old_conn->proxypasswd);
+    Curl_safefree(old_conn->proxyuser);
+    Curl_safefree(old_conn->proxypasswd);
 
     free(old_conn);          /* we don't need this anymore */