diff --git a/openbsc/src/Makefile.am b/openbsc/src/Makefile.am
index e665c99..2d9df99 100644
--- a/openbsc/src/Makefile.am
+++ b/openbsc/src/Makefile.am
@@ -39,6 +39,6 @@
 bsc_mgcp_SOURCES = bsc_mgcp.c msgb.c talloc.c debug.c select.c timer.c telnet_interface.c
 bsc_mgcp_LDADD = libvty.a
 
-ipaccess_firmware_SOURCES = ipaccess/ipaccess-firmware.c
+ipaccess_firmware_SOURCES = ipaccess/ipaccess-firmware.c talloc.c
 
 ipaccess_proxy_SOURCES = ipaccess/ipaccess-proxy.c msgb.c select.c talloc.c debug.c timer.c
diff --git a/openbsc/src/ipaccess/ipaccess-firmware.c b/openbsc/src/ipaccess/ipaccess-firmware.c
index 431fe31..36a42df 100644
--- a/openbsc/src/ipaccess/ipaccess-firmware.c
+++ b/openbsc/src/ipaccess/ipaccess-firmware.c
@@ -21,6 +21,7 @@
 
 #include <openbsc/debug.h>
 #include <openbsc/ipaccess.h>
+#include <openbsc/talloc.h>
 
 #include <arpa/inet.h>
 #include <sys/types.h>
@@ -39,6 +40,9 @@
 /* more magic, the second "int" in the header */
 static char more_magic[] = { 0x10, 0x02 };
 
+/* talloc context */
+void *tall_firm_ctx;
+
 int ipacces_analyze_file(int fd, const unsigned int st_size, const unsigned int base_offset, struct llist_head *list)
 {
 	struct sdp_firmware *firmware_header = 0;
@@ -75,7 +79,7 @@
 	}
 
 	/* add the firmware */
-	header = malloc(sizeof(*header));
+	header = talloc_zero(list, struct sdp_header);
 	header->firmware_info = *firmware_header;
 	INIT_LLIST_HEAD(&header->header_list);
 	llist_add(&header->entry, list);
@@ -114,7 +118,7 @@
 			return -1;
 		}
 
-		header_entry = malloc(sizeof(*header_entry));
+		header_entry = talloc_zero(header,  struct sdp_header_item);
 		header_entry->header_entry = entry;
 		llist_add(&header_entry->entry, &header->header_list);
 
@@ -132,8 +136,10 @@
 	for (i = 1; i < argc; ++i) {
 		struct sdp_header *header;
 		struct sdp_header_item *sub_entry;
-		struct llist_head entry;
-		INIT_LLIST_HEAD(&entry);
+		struct llist_head *entry;
+
+		entry = talloc_zero(tall_firm_ctx, struct llist_head);
+		INIT_LLIST_HEAD(entry);
 
 		printf("Opening possible firmware '%s'\n", argv[i]);
 		fd = open(argv[i], O_RDONLY);
@@ -148,9 +154,9 @@
 			return EXIT_FAILURE;
 		}
 
-		ipacces_analyze_file(fd, stat.st_size, 0, &entry);
+		ipacces_analyze_file(fd, stat.st_size, 0, entry);
 
-		llist_for_each_entry(header, &entry, entry) {
+		llist_for_each_entry(header, entry, entry) {
 			printf("Printing header information:\n");
 			printf("more_more_magic: 0x%x\n", ntohs(header->firmware_info.more_more_magic));
 			printf("header_length: %u\n", ntohl(header->firmware_info.header_length));
@@ -177,8 +183,9 @@
 				printf("\n\n");
 			}
 			printf("\n\n");
-
 		}
+
+		talloc_free(entry);
 	}