diff --git a/src/hb-subset-plan.cc b/src/hb-subset-plan.cc
index 195378d..ba26979 100644
--- a/src/hb-subset-plan.cc
+++ b/src/hb-subset-plan.cc
@@ -107,7 +107,7 @@
 
   if (hb_set_is_empty (layout_features_to_retain)) return;
   unsigned num = layout_features_to_retain->get_population () + 1;
-  hb_tag_t *features = (hb_tag_t *) malloc (num * sizeof (hb_tag_t));
+  hb_tag_t *features = (hb_tag_t *) hb_malloc (num * sizeof (hb_tag_t));
   if (!features) return;
 
   unsigned i = 0;
@@ -123,7 +123,7 @@
 		       features,
 		       lookup_indices);
 
-  free (features);
+  hb_free (features);
 }
 
 template <typename T>
@@ -495,7 +495,7 @@
 
     hb_object_destroy (plan->gsub_langsys);
     plan->gsub_langsys->fini_shallow ();
-    free (plan->gsub_langsys);
+    hb_free (plan->gsub_langsys);
   }
 
   if (plan->gpos_langsys)
@@ -505,8 +505,8 @@
 
     hb_object_destroy (plan->gpos_langsys);
     plan->gpos_langsys->fini_shallow ();
-    free (plan->gpos_langsys);
+    hb_free (plan->gpos_langsys);
   }
 
-  free (plan);
+  hb_free (plan);
 }