diff --git a/src/aead.c b/src/aead.c
index 7ea107fd..023a95eb 100644
--- a/src/aead.c
+++ b/src/aead.c
@@ -331,7 +331,7 @@ aead_cipher_ctx_init(cipher_ctx_t *cipher_ctx, int method, int enc)
     const cipher_kt_t *cipher = aead_get_cipher_type(method);
 
     if (method == AES256GCM && crypto_aead_aes256gcm_is_available()) {
-        cipher_ctx->aes256gcm_ctx = ss_align(sizeof(aes256gcm_ctx));
+        cipher_ctx->aes256gcm_ctx = ss_aligned_malloc(sizeof(aes256gcm_ctx));
         memset(cipher_ctx->aes256gcm_ctx, 0, sizeof(aes256gcm_ctx));
     } else {
         cipher_ctx->aes256gcm_ctx = NULL;
@@ -382,7 +382,7 @@ aead_ctx_release(cipher_ctx_t *cipher_ctx)
     }
 
     if (cipher_ctx->aes256gcm_ctx != NULL) {
-        ss_free(cipher_ctx->aes256gcm_ctx);
+        ss_aligned_free(cipher_ctx->aes256gcm_ctx);
         return;
     }
 
diff --git a/src/local.c b/src/local.c
index 594c82b9..e95388a6 100644
--- a/src/local.c
+++ b/src/local.c
@@ -1246,8 +1246,8 @@ new_server(int fd)
     server->recv_ctx->server    = server;
     server->send_ctx->server    = server;
 
-    server->e_ctx = ss_align(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_align(sizeof(cipher_ctx_t));
+    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
 
diff --git a/src/redir.c b/src/redir.c
index 45eba374..9ca86edc 100644
--- a/src/redir.c
+++ b/src/redir.c
@@ -650,8 +650,8 @@ new_server(int fd)
     server->send_ctx->server    = server;
     server->send_ctx->connected = 0;
 
-    server->e_ctx = ss_align(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_align(sizeof(cipher_ctx_t));
+    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
 
diff --git a/src/server.c b/src/server.c
index 1f9fa059..e0bcc51e 100644
--- a/src/server.c
+++ b/src/server.c
@@ -1415,8 +1415,8 @@ new_server(int fd, listen_ctx_t *listener)
     server->listen_ctx          = listener;
     server->remote              = NULL;
 
-    server->e_ctx = ss_align(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_align(sizeof(cipher_ctx_t));
+    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
 
diff --git a/src/tunnel.c b/src/tunnel.c
index ff4bc86e..d9fa11dd 100644
--- a/src/tunnel.c
+++ b/src/tunnel.c
@@ -664,8 +664,8 @@ new_server(int fd)
     server->send_ctx->server    = server;
     server->send_ctx->connected = 0;
 
-    server->e_ctx = ss_align(sizeof(cipher_ctx_t));
-    server->d_ctx = ss_align(sizeof(cipher_ctx_t));
+    server->e_ctx = ss_malloc(sizeof(cipher_ctx_t));
+    server->d_ctx = ss_malloc(sizeof(cipher_ctx_t));
     crypto->ctx_init(crypto->cipher, server->e_ctx, 1);
     crypto->ctx_init(crypto->cipher, server->d_ctx, 0);
 
diff --git a/src/utils.c b/src/utils.c
index 2b0f052b..6dc17f1d 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -243,7 +243,7 @@ ss_malloc(size_t size)
 }
 
 void *
-ss_align(size_t size)
+ss_aligned_malloc(size_t size)
 {
     int err;
     void *tmp = NULL;
@@ -264,7 +264,7 @@ ss_align(size_t size)
 }
 
 void
-ss_free(void *ptr)
+ss_aligned_free(void *ptr)
 {
 #ifdef __MINGW32__
     _aligned_free(ptr);
@@ -274,6 +274,13 @@ ss_free(void *ptr)
     ptr = NULL;
 }
 
+void
+ss_free(void *ptr)
+{
+    free(ptr);
+    ptr = NULL;
+}
+
 void *
 ss_realloc(void *ptr, size_t new_size)
 {
diff --git a/src/utils.h b/src/utils.h
index b5d501b6..e9ae0530 100644
--- a/src/utils.h
+++ b/src/utils.h
@@ -227,8 +227,9 @@ int set_nofile(int nofile);
 #endif
 
 void *ss_malloc(size_t size);
-void *ss_align(size_t size);
+void *ss_aligned_malloc(size_t size);
 void *ss_realloc(void *ptr, size_t new_size);
+void ss_aligned_free(void *ptr);
 void ss_free(void *ptr);
 
 int ss_is_ipv6addr(const char *addr);