Fix crash with double free()