diff --git a/src/detection/battery/battery_windows.c b/src/detection/battery/battery_windows.c
index 2c48ed964..ed4a1a813 100644
--- a/src/detection/battery/battery_windows.c
+++ b/src/detection/battery/battery_windows.c
@@ -1,14 +1,11 @@
 #include "battery.h"
 #include "util/windows/unicode.h"
+#include "util/mallocHelper.h"
 
 #include <setupapi.h>
 #include <batclass.h>
 #include <devguid.h>
 
-static inline void wrapFree(SP_DEVICE_INTERFACE_DETAIL_DATA_W** ptr)
-{
-    free(*ptr);
-}
 static inline void wrapCloseHandle(HANDLE* handle)
 {
     if(*handle)
@@ -38,7 +35,7 @@ const char* ffDetectBatteryImpl(FFinstance* instance, FFlist* results)
 
         DWORD cbRequired = 0;
         SetupDiGetDeviceInterfaceDetailW(hdev, &did, NULL, 0, &cbRequired, NULL); //Fail with not enough buffer
-        SP_DEVICE_INTERFACE_DETAIL_DATA_W* __attribute__((__cleanup__(wrapFree))) pdidd = (SP_DEVICE_INTERFACE_DETAIL_DATA_W*)malloc(cbRequired);
+        SP_DEVICE_INTERFACE_DETAIL_DATA_W* FF_AUTO_FREE pdidd = (SP_DEVICE_INTERFACE_DETAIL_DATA_W*)malloc(cbRequired);
         if(!pdidd)
             break; //Out of memory
 
diff --git a/src/detection/cpu/cpu_windows.c b/src/detection/cpu/cpu_windows.c
index c7db11aad..6fe9065e8 100644
--- a/src/detection/cpu/cpu_windows.c
+++ b/src/detection/cpu/cpu_windows.c
@@ -1,10 +1,6 @@
 #include "cpu.h"
 #include "util/windows/register.h"
-
-static inline void wrapFree(SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX** ptr)
-{
-    free(*ptr);
-}
+#include "util/mallocHelper.h"
 
 void ffDetectCPUImpl(const FFinstance* instance, FFCPUResult* cpu, bool cached)
 {
@@ -23,7 +19,7 @@ void ffDetectCPUImpl(const FFinstance* instance, FFCPUResult* cpu, bool cached)
     {
         DWORD length = 0;
         GetLogicalProcessorInformationEx(RelationProcessorCore, NULL, &length);
-        SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX* __attribute__((__cleanup__(wrapFree)))
+        SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX* FF_AUTO_FREE
             pLogicalInfo = (SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX*)malloc(length);
 
         if(pLogicalInfo && GetLogicalProcessorInformationEx(RelationProcessorCore, pLogicalInfo, &length))
diff --git a/src/detection/processes/processes_windows.cpp b/src/detection/processes/processes_windows.cpp
index 052162d2b..2b267c4a5 100644
--- a/src/detection/processes/processes_windows.cpp
+++ b/src/detection/processes/processes_windows.cpp
@@ -1,16 +1,12 @@
 extern "C" {
 #include "processes.h"
+#include "util/mallocHelper.h"
 }
 
 #ifdef FF_USE_WIN_NTAPI
 
 #include <winternl.h>
 
-static inline void wrapFree(SYSTEM_PROCESS_INFORMATION** ptr)
-{
-    free(*ptr);
-}
-
 uint32_t ffDetectProcesses(FFinstance* instance, FFstrbuf* error)
 {
     FF_UNUSED(instance);
@@ -23,7 +19,7 @@ uint32_t ffDetectProcesses(FFinstance* instance, FFstrbuf* error)
     }
     size += sizeof(SystemProcessInformation) * 5; //What if new processes are created during two syscalls?
 
-    SYSTEM_PROCESS_INFORMATION* __attribute__((__cleanup__(wrapFree))) pstart = (SYSTEM_PROCESS_INFORMATION*)malloc(size);
+    SYSTEM_PROCESS_INFORMATION* FF_AUTO_FREE pstart = (SYSTEM_PROCESS_INFORMATION*)malloc(size);
     if(!pstart)
     {
         ffStrbufAppendF(error, "malloc(%u) failed", (unsigned)size);
diff --git a/src/util/mallocHelper.h b/src/util/mallocHelper.h
new file mode 100644
index 000000000..a4fd8eb6e
--- /dev/null
+++ b/src/util/mallocHelper.h
@@ -0,0 +1,9 @@
+#include <stdlib.h>
+
+static inline void ffWrapFree(void* pPtr)
+{
+    if(*(void**)pPtr)
+        free(*(void**)pPtr);
+}
+
+#define FF_AUTO_FREE __attribute__((__cleanup__(ffWrapFree)))