coverity: read from pointer after free

sesman/chansrv/chansrv_fuse.c

@@ -2626,7 +2626,6 @@ static void xfuse_cb_release(fuse_req_t req, fuse_ino_t ino, struct
               fip, fip->fi, fip->fi->fh);
 
     FileId = handle->FileId;
-    free(handle);
     fip->fi->fh = 0;
     xinode->close_in_progress = 1;
 
@@ -2635,6 +2634,8 @@ static void xfuse_cb_release(fuse_req_t req, fuse_ino_t ino, struct
         log_error("failed to send devredir_close_file() cmd");
         fuse_reply_err(req, EREMOTEIO);
     }
+
+    free(handle);
 }
 
 /**

xrdp/xrdp_mm.c

@@ -2374,8 +2374,8 @@ server_paint_rects(struct xrdp_mod* mod, int num_drects, short *drects,
                            g_malloc(sizeof(short) * num_crects * 4, 0);
         if (enc_data->crects == 0)
         {
-            g_free(enc_data);
             g_free(enc_data->drects);
+            g_free(enc_data);
             return 1;
         }