diff --git a/trunk/src/app/srs_app_rtc_conn.cpp b/trunk/src/app/srs_app_rtc_conn.cpp
index ffab0f6e5..dd9a791b2 100644
--- a/trunk/src/app/srs_app_rtc_conn.cpp
+++ b/trunk/src/app/srs_app_rtc_conn.cpp
@@ -1212,6 +1212,10 @@ srs_error_t SrsRtcSenderThread::packet_nalus(SrsSharedPtrMessage* msg, SrsRtcPac
 
         packet->payload = raw;
     } else {
+        // We must free it, should never use RTP packets to free it,
+        // because more than one RTP packet will refer to it.
+        SrsAutoFree(SrsRtpRawNALUs, raw);
+
         // Package NALUs in FU-A RTP packets.
         int fu_payload_size = kRtpMaxPayloadSize;
 
@@ -1229,7 +1233,6 @@ srs_error_t SrsRtcSenderThread::packet_nalus(SrsSharedPtrMessage* msg, SrsRtcPac
                 srs_freep(raw);
                 return srs_error_new(ERROR_RTC_RTP_MUXER, "cache empty");
             }
-            packet->extra_payload = raw;
 
             packet->rtp_header.set_timestamp(msg->timestamp * 90);
             packet->rtp_header.set_sequence(video_sequence++);
diff --git a/trunk/src/kernel/srs_kernel_rtp.cpp b/trunk/src/kernel/srs_kernel_rtp.cpp
index a61b360a3..5c23cbd34 100644
--- a/trunk/src/kernel/srs_kernel_rtp.cpp
+++ b/trunk/src/kernel/srs_kernel_rtp.cpp
@@ -151,7 +151,6 @@ size_t SrsRtpHeader::header_size()
 SrsRtpPacket2::SrsRtpPacket2()
 {
     payload = NULL;
-    extra_payload = NULL;
     padding = 0;
 
     cache_raw = new SrsRtpRawPayload();
@@ -167,7 +166,6 @@ SrsRtpPacket2::~SrsRtpPacket2()
     }
 
     srs_freep(payload);
-    srs_freep(extra_payload);
     srs_freep(cache_raw);
     srs_freep(cache_fua);
 }
@@ -195,7 +193,6 @@ void SrsRtpPacket2::reset()
     rtp_header.reset();
     padding = 0;
     cache_payload = 0;
-    srs_freep(extra_payload);
 
     // We may use the cache as payload.
     if (payload == cache_raw || payload == cache_fua) {
@@ -330,7 +327,7 @@ srs_error_t SrsRtpRawNALUs::read_samples(vector<SrsSample*>& samples, int packet
     int left = packet_size;
 
     int nn_nalus = (int)nalus.size();
-    for (int i = 0; i < nn_nalus; i++) {
+    for (int i = 0; left > 0 && i < nn_nalus; i++) {
         SrsSample* p = nalus[i];
 
         // Ignore previous consumed samples.
diff --git a/trunk/src/kernel/srs_kernel_rtp.hpp b/trunk/src/kernel/srs_kernel_rtp.hpp
index 31b59ec85..349c388a5 100644
--- a/trunk/src/kernel/srs_kernel_rtp.hpp
+++ b/trunk/src/kernel/srs_kernel_rtp.hpp
@@ -84,11 +84,6 @@ public:
     SrsRtpHeader rtp_header;
     ISrsEncoder* payload;
     int padding;
-public:
-    // User can set an extra payload, we will free it.
-    // For example, when reassemble NALUs by SrsRtpRawNALUs, we can set the extra payload to
-    // SrsRtpRawNALUs, then we can use SrsRtpFUAPayload which never free samples.
-    ISrsEncoder* extra_payload;
 private:
     SrsRtpRawPayload* cache_raw;
     SrsRtpFUAPayload2* cache_fua;