diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c
index 560bec55f1..3efeabe786 100644
--- a/src/or/circuitlist.c
+++ b/src/or/circuitlist.c
@@ -504,7 +504,7 @@ circuit_free(circuit_t *circ)
    * "active" checks will be violated. */
   cell_queue_clear(&circ->n_conn_cells);
 
-  memset(circ, 0xAA, memlen); /* poison memory */
+  memset(mem, 0xAA, memlen); /* poison memory */
   tor_free(mem);
 }
 
diff --git a/src/or/connection.c b/src/or/connection.c
index aca9b8b116..48740412c4 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -423,7 +423,7 @@ _connection_free(connection_t *conn)
     connection_or_remove_from_identity_map(TO_OR_CONN(conn));
   }
 
-  memset(conn, 0xAA, memlen); /* poison memory */
+  memset(mem, 0xAA, memlen); /* poison memory */
   tor_free(mem);
 }