kc3-lang/freetype

diff --git a/ChangeLog b/ChangeLog
index 1024f71..c11716f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2016-10-11  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttgxvar.c (tt_done_blend): Fix deallocation.
+
 2016-10-08  Werner Lemberg  <wl@gnu.org>
 
 	* src/cid/cidload.c (cid_face_open): Properly propagate `error'.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index b82b2d8..52d612e 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -2163,15 +2163,18 @@
   {
     if ( blend != NULL )
     {
-      FT_UInt  i;
+      FT_UInt  i, num_axes;
 
 
+      /* blend->num_axis might not be set up yet */
+      num_axes = blend->mmvar->num_axis;
+
       FT_FREE( blend->normalizedcoords );
       FT_FREE( blend->mmvar );
 
       if ( blend->avar_segment != NULL )
       {
-        for ( i = 0; i < blend->num_axis; i++ )
+        for ( i = 0; i < num_axes; i++ )
           FT_FREE( blend->avar_segment[i].correspondence );
         FT_FREE( blend->avar_segment );
       }