Index: cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
===================================================================
--- cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
+++ cfe/trunk/lib/StaticAnalyzer/Checkers/MallocChecker.cpp
@@ -2075,8 +2075,8 @@
 
   if (ExplodedNode *N = C.generateErrorNode()) {
     if (!BT_BadFree[*CheckKind])
-      BT_BadFree[*CheckKind].reset(
-          new BugType(CheckNames[*CheckKind], "Bad free", "Memory Error"));
+      BT_BadFree[*CheckKind].reset(new BugType(
+          CheckNames[*CheckKind], "Bad free", categories::MemoryError));
 
     SmallString<100> Buf;
     llvm::raw_svector_ostream Os(Buf);
Index: cfe/trunk/test/Analysis/malloc-fnptr-plist.c
===================================================================
--- cfe/trunk/test/Analysis/malloc-fnptr-plist.c
+++ cfe/trunk/test/Analysis/malloc-fnptr-plist.c
@@ -0,0 +1,11 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker core,unix.Malloc -analyzer-output=plist -o %t.plist -verify %s
+// RUN: FileCheck --input-file=%t.plist %s
+
+void free(void *);
+void (*fnptr)(int);
+void foo() {
+  free((void *)fnptr); // expected-warning{{Argument to free() is a function pointer}}
+}
+
+// Make sure the bug category is correct.
+// CHECK: <key>category</key><string>Memory error</string>