The return value from CanvasRenderer::_dofont is a pointer. It will be passed to the free function. Ensure that pointer always points to a dynamically allocated memory to avoid segmentation faults.
3909c8dbcc