diff --git a/README.md b/README.md
index 032d8740e..bb4b44987 100755
--- a/README.md
+++ b/README.md
@@ -220,6 +220,7 @@ Please select according to languages:
 
 ### V2 changes
 
+* v2.0, 2018-07-21, Merge [#1119][bug #1119], fix memory leak. 2.0.249
 * <strong>v2.0, 2018-07-18, [2.0 release3(2.0.248)][r2.0r3] released. 86775 lines.</strong>
 * v2.0, 2018-07-17, Merge [#1176][bug #1176], fix scaned issues. 2.0.248
 * v2.0, 2018-02-28, Merge [#1077][bug #1077], fix crash for edge HLS. 2.0.247
@@ -1424,6 +1425,7 @@ Winlin
 [bug #1059]: https://github.com/ossrs/srs/issues/1059
 [bug #1077]: https://github.com/ossrs/srs/issues/1077
 [bug #1176]: https://github.com/ossrs/srs/issues/1176
+[bug #1119]: https://github.com/ossrs/srs/issues/1119
 [bug #xxxxxxxxxx]: https://github.com/ossrs/srs/issues/xxxxxxxxxx
 
 [bug #735]: https://github.com/ossrs/srs/issues/735
diff --git a/trunk/src/kernel/srs_kernel_ts.cpp b/trunk/src/kernel/srs_kernel_ts.cpp
index 108567662..f147a8339 100644
--- a/trunk/src/kernel/srs_kernel_ts.cpp
+++ b/trunk/src/kernel/srs_kernel_ts.cpp
@@ -182,8 +182,11 @@ SrsTsMessage* SrsTsMessage::detach()
     cp->sid = sid;
     cp->PES_packet_length = PES_packet_length;
     cp->continuity_counter = continuity_counter;
+    
+    srs_freep(cp->payload);
     cp->payload = payload;
     payload = NULL;
+    
     return cp;
 }
 
diff --git a/trunk/src/main/srs_main_ingest_hls.cpp b/trunk/src/main/srs_main_ingest_hls.cpp
index 3caa5968d..a17c6946b 100644
--- a/trunk/src/main/srs_main_ingest_hls.cpp
+++ b/trunk/src/main/srs_main_ingest_hls.cpp
@@ -906,10 +906,12 @@ int SrsIngestHlsOutput::parse_message_queue()
         std::multimap<int64_t, SrsTsMessage*>::iterator it = queue.begin();
         
         SrsTsMessage* msg = it->second;
+        SrsAutoFree(SrsTsMessage, msg);
+        queue.erase(it);
+        
         if (msg->channel->stream == SrsTsStreamVideoH264) {
             nb_videos--;
         }
-        queue.erase(it);
         
         // parse the stream.
         SrsBuffer avs(msg->payload->bytes(), msg->payload->length());
@@ -939,6 +941,7 @@ int SrsIngestHlsOutput::flush_message_queue()
         std::multimap<int64_t, SrsTsMessage*>::iterator it = queue.begin();
         
         SrsTsMessage* msg = it->second;
+        SrsAutoFree(SrsTsMessage, msg);
         queue.erase(it);
         
         // parse the stream.