diff --git a/0001-Fix-wrong-Xfree-in-XListFonts-failure-path.patch b/0001-Fix-wrong-Xfree-in-XListFonts-failure-path.patch
new file mode 100644
index 0000000..947a861
--- /dev/null
+++ b/0001-Fix-wrong-Xfree-in-XListFonts-failure-path.patch
@@ -0,0 +1,58 @@
+From c74b070f2712c95f0db7c320a10232b0e5c83049 Mon Sep 17 00:00:00 2001
+From: Julien Cristau <jcristau@debian.org>
+Date: Sat, 7 Jan 2017 16:20:31 +0100
+Subject: [PATCH libX11] Fix wrong Xfree in XListFonts failure path
+
+'ch' gets moved inside the allocated buffer as we're looping through
+fonts, so keep a reference to the start of the buffer so we can pass
+that to Xfree in the failure case.
+
+Fixes: commit 20a3f99eba5001925b8b313da3accb7900eb1927 "Plug a memory leak"
+
+Signed-off-by: Julien Cristau <jcristau@debian.org>
+Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ src/FontNames.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/FontNames.c b/src/FontNames.c
+index 3e23b5f..9ffdfd2 100644
+--- a/src/FontNames.c
++++ b/src/FontNames.c
+@@ -43,6 +43,7 @@ int *actualCount)	/* RETURN */
+     register int length;
+     char **flist = NULL;
+     char *ch = NULL;
++    char *chstart;
+     char *chend;
+     int count = 0;
+     xListFontsReply rep;
+@@ -86,6 +87,7 @@ int *actualCount)	/* RETURN */
+ 	/*
+ 	 * unpack into null terminated strings.
+ 	 */
++	chstart = ch;
+ 	chend = ch + (rlen + 1);
+ 	length = *(unsigned char *)ch;
+ 	*ch = 1; /* make sure it is non-zero for XFreeFontNames */
+@@ -98,14 +100,14 @@ int *actualCount)	/* RETURN */
+ 		    *ch = '\0';  /* and replace with null-termination */
+ 		    count++;
+ 		} else {
+-                    Xfree(ch);
++                    Xfree(chstart);
+                     Xfree(flist);
+                     flist = NULL;
+                     count = 0;
+                     break;
+ 		}
+ 	    } else {
+-                Xfree(ch);
++                Xfree(chstart);
+                 Xfree(flist);
+                 flist = NULL;
+                 count = 0;
+-- 
+2.9.3
+
diff --git a/libX11.spec b/libX11.spec
index a5f6d29..9120bb5 100644
--- a/libX11.spec
+++ b/libX11.spec
@@ -5,7 +5,7 @@
 Summary: Core X11 protocol client library
 Name: libX11
 Version: 1.6.4
-Release: 2%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
+Release: 3%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
 License: MIT
 Group: System Environment/Libraries
 URL: http://www.x.org
@@ -20,6 +20,7 @@ Source0: http://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.t
 
 Patch2: dont-forward-keycode-0.patch
 Patch3: 0001-Plug-a-memory-leak.patch
+Patch4: 0001-Fix-wrong-Xfree-in-XListFonts-failure-path.patch
 
 BuildRequires: xorg-x11-util-macros >= 1.11
 BuildRequires: pkgconfig(xproto) >= 7.0.15
@@ -112,6 +113,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man5/*.5*
 
 %changelog
+* Mon Jan 09 2017 Peter Hutterer <peter.hutterer@redhat.com> 1.6.4-3
+- Fix a bug in the memory leak fix from 1.6.4-2
+
 * Thu Jan 05 2017 Peter Hutterer <peter.hutterer@redhat.com> 1.6.4-2
 - Plug a memory leak in XListFonts()