diff --git a/CHANGES b/CHANGES
index 06bf808292..ffbc3213a9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+2.4-280 | 2016-02-13 10:40:16 -0800
+
+  * Fix memory leaks in stats.cc and smb.cc. (Johanna Amann)
+
 2.4-278 | 2016-02-12 18:53:35 -0800
 
   * Better multi-space separator handline. (Mark Taylor & Johanna Amann)
diff --git a/VERSION b/VERSION
index 45f7a1f8c1..28fb8abb16 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4-278
+2.4-280
diff --git a/src/Stats.cc b/src/Stats.cc
index 00f603cba7..eb5ac67e26 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -362,12 +362,16 @@ SampleLogger::~SampleLogger()
 
 void SampleLogger::FunctionSeen(const Func* func)
 	{
-	load_samples->Assign(new StringVal(func->Name()), 0);
+	Val* idx = new StringVal(func->Name());
+	load_samples->Assign(idx, 0);
+	Unref(idx);
 	}
 
 void SampleLogger::LocationSeen(const Location* loc)
 	{
-	load_samples->Assign(new StringVal(loc->filename), 0);
+	Val* idx = new StringVal(loc->filename);
+	load_samples->Assign(idx, 0);
+	Unref(idx);
 	}
 
 void SampleLogger::SegmentProfile(const char* /* name */,
diff --git a/src/Val.h b/src/Val.h
index c418addd55..86d75af94a 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -753,10 +753,11 @@ public:
 	TableVal(TableType* t, Attributes* attrs = 0);
 	~TableVal();
 
-	// Returns true if the assignment typechecked, false if not.
-	// Second version takes a HashKey and Unref()'s it when done.
-	// If we're a set, new_val has to be nil.
-	// If we aren't a set, index may be nil in the second version.
+	// Returns true if the assignment typechecked, false if not. The
+	// methods take ownership of new_val, but not of the index. Second
+	// version takes a HashKey and Unref()'s it when done. If we're a
+	// set, new_val has to be nil. If we aren't a set, index may be nil
+	// in the second version.
 	int Assign(Val* index, Val* new_val, Opcode op = OP_ASSIGN);
 	int Assign(Val* index, HashKey* k, Val* new_val, Opcode op = OP_ASSIGN);
 
diff --git a/src/analyzer/protocol/smb/SMB.cc b/src/analyzer/protocol/smb/SMB.cc
index 9d388a0886..f72dbf4e19 100644
--- a/src/analyzer/protocol/smb/SMB.cc
+++ b/src/analyzer/protocol/smb/SMB.cc
@@ -336,7 +336,9 @@ int SMB_Session::ParseNegotiate(binpac::SMB::SMB_header const& hdr,
 			{
 			binpac::SMB::SMB_dialect* d = (*msg.dialects())[i];
 			BroString* tmp = ExtractString(d->dialectname());
-			t->Assign(new Val(i, TYPE_COUNT), new StringVal(tmp));
+			Val* idx = new Val(i, TYPE_COUNT);
+			t->Assign(idx, new StringVal(tmp));
+			Unref(idx);
 			}
 
 		val_list* vl = new val_list;
diff --git a/testing/btest/core/leaks/stats.bro b/testing/btest/core/leaks/stats.bro
new file mode 100644
index 0000000000..a3459fdc93
--- /dev/null
+++ b/testing/btest/core/leaks/stats.bro
@@ -0,0 +1,15 @@
+# Needs perftools support.
+#
+# @TEST-GROUP: leaks
+#
+# @TEST-REQUIRES: bro  --help 2>&1 | grep -q mem-leaks
+#
+# @TEST-EXEC: HEAP_CHECK_DUMP_DIRECTORY=. HEAPCHECK=local btest-bg-run bro bro -m -r $TRACES/wikipedia.trace %INPUT
+# @TEST-EXEC: btest-bg-wait 60
+
+@load policy/misc/stats.bro
+
+event load_sample(samples: load_sample_info, CPU: interval, dmem: int)
+	{
+	print CPU;
+	}