diff --git a/src/lte/model/lte-enb-rrc.cc b/src/lte/model/lte-enb-rrc.cc
index eae38392a..2ccb444b6 100644
--- a/src/lte/model/lte-enb-rrc.cc
+++ b/src/lte/model/lte-enb-rrc.cc
@@ -266,13 +266,6 @@ void
 UeManager::DoDispose ()
 {
   delete m_drbPdcpSapUser;
-  
-  m_rrc->m_cmacSapProvider->RemoveUe (m_rnti);
-  m_rrc->m_cphySapProvider->RemoveUe (m_rnti);
-  if (m_rrc->m_s1SapProvider != 0)
-    {
-      m_rrc->m_s1SapProvider->UeContextRelease (m_rnti);
-    }
   // delete eventual X2-U TEIDs
   for (std::map <uint8_t, Ptr<LteDataRadioBearerInfo> >::iterator it = m_drbMap.begin ();
        it != m_drbMap.end ();
@@ -1188,6 +1181,7 @@ void
 LteEnbRrc::DoDispose ()
 {
   NS_LOG_FUNCTION (this);
+  m_ueMap.clear ();
   delete m_cmacSapUser;
   delete m_rrcSapProvider;
   delete m_x2SapUser;
@@ -1735,6 +1729,12 @@ LteEnbRrc::RemoveUe (uint16_t rnti)
   NS_ASSERT_MSG (it != m_ueMap.end (), "request to remove UE info with unknown rnti " << rnti);
   uint16_t srsCi = (*it).second->GetSrsConfigurationIndex ();
   m_ueMap.erase (it);
+  m_cmacSapProvider->RemoveUe (rnti);
+  m_cphySapProvider->RemoveUe (rnti);
+  if (m_s1SapProvider != 0)
+    {
+      m_s1SapProvider->UeContextRelease (rnti);
+    }
   // need to do this after UeManager has been deleted
   RemoveSrsConfigurationIndex (srsCi); 
  }
diff --git a/src/lte/model/lte-rrc-protocol-real.cc b/src/lte/model/lte-rrc-protocol-real.cc
index d10c86e21..45582c044 100644
--- a/src/lte/model/lte-rrc-protocol-real.cc
+++ b/src/lte/model/lte-rrc-protocol-real.cc
@@ -47,6 +47,8 @@ LteUeRrcProtocolReal::LteUeRrcProtocolReal ()
     m_enbRrcSapProvider (0)
 {
   m_ueRrcSapUser = new MemberLteUeRrcSapUser<LteUeRrcProtocolReal> (this);
+  m_completeSetupParameters.srb0SapUser = new LteRlcSpecificLteRlcSapUser<LteUeRrcProtocolReal> (this);
+  m_completeSetupParameters.srb1SapUser = new LtePdcpSpecificLtePdcpSapUser<LteUeRrcProtocolReal> (this);    
 }
 
 LteUeRrcProtocolReal::~LteUeRrcProtocolReal ()
@@ -97,14 +99,7 @@ LteUeRrcProtocolReal::DoSetup (LteUeRrcSapUser::SetupParameters params)
   NS_LOG_FUNCTION (this);
 
   m_setupParameters.srb0SapProvider = params.srb0SapProvider;
-  m_setupParameters.srb1SapProvider = params.srb1SapProvider;
-
-  LteRlcSapUser* srb0SapUser = new LteRlcSpecificLteRlcSapUser<LteUeRrcProtocolReal> (this);
-  LtePdcpSapUser* srb1SapUser = new LtePdcpSpecificLtePdcpSapUser<LteUeRrcProtocolReal> (this);
-
-  m_completeSetupParameters.srb0SapUser = srb0SapUser;
-  m_completeSetupParameters.srb1SapUser = srb1SapUser;
-
+  m_setupParameters.srb1SapProvider = params.srb1SapProvider; 
   m_ueRrcSapProvider->CompleteSetup (m_completeSetupParameters);
 }
 
@@ -374,6 +369,15 @@ LteEnbRrcProtocolReal::DoDispose ()
 {
   NS_LOG_FUNCTION (this);
   delete m_enbRrcSapUser;
+  for (std::map<uint16_t, LteEnbRrcSapProvider::CompleteSetupUeParameters>::iterator 
+         it = m_completeSetupUeParametersMap.begin ();
+       it != m_completeSetupUeParametersMap.end ();
+       ++it)
+    {     
+      delete it->second.srb0SapUser;
+      delete it->second.srb1SapUser;
+    }
+  m_completeSetupUeParametersMap.clear ();
 }
 
 TypeId
@@ -481,6 +485,12 @@ void
 LteEnbRrcProtocolReal::DoRemoveUe (uint16_t rnti)
 {
   NS_LOG_FUNCTION (this << rnti);
+  std::map<uint16_t, LteEnbRrcSapProvider::CompleteSetupUeParameters>::iterator 
+    it = m_completeSetupUeParametersMap.find (rnti);
+  NS_ASSERT (it != m_completeSetupUeParametersMap.end ());
+  delete it->second.srb0SapUser;
+  delete it->second.srb1SapUser;
+  m_completeSetupUeParametersMap.erase (it);
   m_enbRrcSapProviderMap.erase (rnti);
   m_setupUeParametersMap.erase (rnti);
 }
diff --git a/src/lte/model/lte-ue-rrc.cc b/src/lte/model/lte-ue-rrc.cc
index 4158aace8..8e907d3f3 100644
--- a/src/lte/model/lte-ue-rrc.cc
+++ b/src/lte/model/lte-ue-rrc.cc
@@ -152,6 +152,7 @@ LteUeRrc::DoDispose ()
   NS_LOG_FUNCTION (this);
   delete m_cphySapUser;
   delete m_cmacSapUser;
+  delete m_rrcSapProvider;
   delete m_drbPdcpSapUser;
   delete m_asSapProvider;
   m_drbMap.clear ();