diff --git a/src/lib/curl/Easy.hxx b/src/lib/curl/Easy.hxx
index a2f134a77..4d813511e 100644
--- a/src/lib/curl/Easy.hxx
+++ b/src/lib/curl/Easy.hxx
@@ -30,6 +30,8 @@
 #ifndef CURL_EASY_HXX
 #define CURL_EASY_HXX
 
+#include "String.hxx"
+
 #include <curl/curl.h>
 
 #include <utility>
@@ -88,8 +90,8 @@ public:
 			throw std::runtime_error(curl_easy_strerror(code));
 	}
 
-	char *Escape(const char *string, int length=0) const noexcept {
-		return curl_easy_escape(handle, string, length);
+	CurlString Escape(const char *string, int length=0) const noexcept {
+		return CurlString(curl_easy_escape(handle, string, length));
 	}
 };
 
diff --git a/src/lib/curl/Form.cxx b/src/lib/curl/Form.cxx
index 7e9d84753..65430641d 100644
--- a/src/lib/curl/Form.cxx
+++ b/src/lib/curl/Form.cxx
@@ -28,6 +28,7 @@
  */
 
 #include "Form.hxx"
+#include "String.hxx"
 
 std::string
 EncodeForm(CURL *curl,
@@ -43,12 +44,10 @@ EncodeForm(CURL *curl,
 		result.push_back('=');
 
 		if (!i.second.empty()) {
-			char *value = curl_easy_escape(curl, i.second.data(),
-						       i.second.length());
-			if (value != nullptr) {
+			CurlString value(curl_easy_escape(curl, i.second.data(),
+							  i.second.length()));
+			if (value)
 				result.append(value);
-				curl_free(value);
-			}
 		}
 	}
 
diff --git a/src/lib/curl/String.hxx b/src/lib/curl/String.hxx
new file mode 100644
index 000000000..f39c28992
--- /dev/null
+++ b/src/lib/curl/String.hxx
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2019 Max Kellermann <max.kellermann@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * - Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * - Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
+ * FOUNDATION OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CURL_STRING_HXX
+#define CURL_STRING_HXX
+
+#include <curl/curl.h>
+
+#include <utility>
+
+/**
+ * An OO wrapper for an allocated string to be freed with curl_free().
+ */
+class CurlString {
+	char *p = nullptr;
+
+public:
+	CurlString() noexcept = default;
+	CurlString(std::nullptr_t) noexcept {}
+
+	explicit CurlString(char *_p) noexcept
+		:p(_p) {}
+
+	CurlString(CurlString &&src) noexcept
+		:p(std::exchange(src.p, nullptr)) {}
+
+	~CurlString() noexcept {
+		if (p != nullptr)
+			curl_free(p);
+	}
+
+	CurlString &operator=(CurlString &&src) noexcept {
+		using std::swap;
+		swap(p, src.p);
+		return *this;
+	}
+
+	operator bool() const noexcept {
+		return p != nullptr;
+	}
+
+	operator const char *() const noexcept {
+		return p;
+	}
+
+	const char *c_str() const noexcept {
+		return p;
+	}
+};
+
+#endif
diff --git a/src/storage/plugins/CurlStorage.cxx b/src/storage/plugins/CurlStorage.cxx
index 0c9293b10..0e6f45a81 100644
--- a/src/storage/plugins/CurlStorage.cxx
+++ b/src/storage/plugins/CurlStorage.cxx
@@ -25,6 +25,7 @@
 #include "lib/curl/Init.hxx"
 #include "lib/curl/Global.hxx"
 #include "lib/curl/Slist.hxx"
+#include "lib/curl/String.hxx"
 #include "lib/curl/Request.hxx"
 #include "lib/curl/Handler.hxx"
 #include "lib/expat/ExpatParser.hxx"
@@ -81,11 +82,10 @@ CurlStorage::MapUTF8(const char *uri_utf8) const noexcept
 	std::string path_esc;
 
 	for (auto elt: IterableSplitString(uri_utf8, '/')) {
-		char *elt_esc = easy.Escape(elt.data, elt.size);
+		const auto elt_esc = easy.Escape(elt.data, elt.size);
 		if (!path_esc.empty())
 			path_esc.push_back('/');
-		path_esc += elt_esc;
-		curl_free(elt_esc);
+		path_esc += elt_esc.c_str();
 	}
 
 	return PathTraitsUTF8::Build(base.c_str(), path_esc.c_str());