diff --git a/.pick_status.json b/.pick_status.json
index 614824f3c1f..9faadfd1cba 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -1903,7 +1903,7 @@
         "description": "frontends/va: Fix memory leak of decrypt_key",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "deb7dc82f626e92525d01829d88f0ac348de03b8"
     },
diff --git a/src/gallium/frontends/va/context.c b/src/gallium/frontends/va/context.c
index d02f558cc51..c4ce4cbfc5d 100644
--- a/src/gallium/frontends/va/context.c
+++ b/src/gallium/frontends/va/context.c
@@ -411,6 +411,7 @@ vlVaDestroyContext(VADriverContextP ctx, VAContextID context_id)
       vl_deint_filter_cleanup(context->deint);
       FREE(context->deint);
    }
+   FREE(context->desc.base.decrypt_key);
    FREE(context);
    handle_table_remove(drv->htab, context_id);
    mtx_unlock(&drv->mutex);
diff --git a/src/gallium/frontends/va/picture.c b/src/gallium/frontends/va/picture.c
index 58ccfee0f1b..fe3fee9c37a 100644
--- a/src/gallium/frontends/va/picture.c
+++ b/src/gallium/frontends/va/picture.c
@@ -323,10 +323,15 @@ static void
 handleVAProtectedSliceDataBufferType(vlVaContext *context, vlVaBuffer *buf)
 {
 	uint8_t* encrypted_data = (uint8_t*) buf->data;
+        uint8_t* drm_key;
 
 	unsigned int drm_key_size = buf->size;
 
-	context->desc.base.decrypt_key = CALLOC(1, drm_key_size);
+        drm_key = REALLOC(context->desc.base.decrypt_key,
+                          context->desc.base.key_size, drm_key_size);
+        if (!drm_key)
+            return;
+        context->desc.base.decrypt_key = drm_key;
 	memcpy(context->desc.base.decrypt_key, encrypted_data, drm_key_size);
 	context->desc.base.key_size = drm_key_size;
 	context->desc.base.protected_playback = true;