diff --git a/NEWS b/NEWS
index cf24c116..3fe6c0e4 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,10 @@
 D-Bus 1.7.6 (UNRELEASED)
 ==
 
-...
+Fixes:
+
+• If malloc() returns NULL in _dbus_string_init() or similar, don't free
+  an invalid pointer if the string is later freed (fd.o #65959, Chengwei Yang)
 
 D-Bus 1.7.4 (2013-06-13)
 ==
diff --git a/dbus/dbus-string.c b/dbus/dbus-string.c
index e3766aad..52eb0f23 100644
--- a/dbus/dbus-string.c
+++ b/dbus/dbus-string.c
@@ -246,6 +246,14 @@ _dbus_string_free (DBusString *str)
   
   if (real->constant)
     return;
+
+  /* so it's safe if @p str returned by a failed
+   * _dbus_string_init call
+   * Bug: https://bugs.freedesktop.org/show_bug.cgi?id=65959
+   */
+  if (real->str == NULL)
+    return;
+
   dbus_free (real->str - real->align_offset);
 
   real->invalid = TRUE;