diff --git a/OpenSSL/crypto.py b/OpenSSL/crypto.py
index 191566b..f7e9239 100644
--- a/OpenSSL/crypto.py
+++ b/OpenSSL/crypto.py
@@ -1301,7 +1301,9 @@
         """
         Create a new empty CRL object.
         """
-        self._crl = _api.X509_CRL_new()
+        crl = _api.X509_CRL_new()
+        self._crl = _api.ffi.gc(crl, _api.X509_CRL_free)
+        
 
 
     def get_revoked(self):
@@ -1625,7 +1627,8 @@
 
 class NetscapeSPKI(object):
     def __init__(self):
-        self._spki = _api.NETSCAPE_SPKI_new()
+        spki = _api.NETSCAPE_SPKI_new()
+        self._spki = _api.ffi.gc(spki, _api.NETSCAPE_SPKI_free)
 
 
     def sign(self, pkey, digest):
@@ -1672,7 +1675,10 @@
 
         :return: The base64 encoded string
         """
-        return _api.string(_api.NETSCAPE_SPKI_b64_encode(self._spki))
+        encoded = _api.NETSCAPE_SPKI_b64_encode(self._spki)
+        result = _api.string(encoded)
+        _api.CRYPTO_free(encoded)
+        return result
 
 
     def get_pubkey(self):
@@ -1685,6 +1691,7 @@
         pkey._pkey = _api.NETSCAPE_SPKI_get_pubkey(self._spki)
         if pkey._pkey == _api.NULL:
             1/0
+        pkey._pkey = _api.ffi.gc(pkey._pkey, _api.EVP_PKEY_free)
         pkey._only_public = True
         return pkey
 
@@ -1980,8 +1987,6 @@
     cert = _api.new("X509**")
     cacerts = _api.new("struct stack_st_X509**")
 
-    import pdb; pdb.set_trace()
-
     parse_result = _api.PKCS12_parse(p12, passphrase, pkey, cert, cacerts)
     if not parse_result:
         _raise_current_error()