diff --git a/src/util/json.c b/src/util/json.c
index f90594cb1d..be47f64031 100644
--- a/src/util/json.c
+++ b/src/util/json.c
@@ -65,7 +65,7 @@ void virJSONValueFree(virJSONValuePtr value)
 
     switch (value->type) {
     case VIR_JSON_TYPE_OBJECT:
-        for (i = 0 ; i < value->data.array.nvalues ; i++) {
+        for (i = 0 ; i < value->data.object.npairs; i++) {
             VIR_FREE(value->data.object.pairs[i].key);
             virJSONValueFree(value->data.object.pairs[i].value);
         }
@@ -897,6 +897,7 @@ virJSONValuePtr virJSONValueFromString(const char *jsonstring)
     yajl_parser_config cfg = { 1, 1 };
     yajl_handle hand;
     virJSONParser parser = { NULL, NULL, 0 };
+    virJSONValuePtr ret = NULL;
 
     VIR_DEBUG("string=%s", jsonstring);
 
@@ -917,6 +918,8 @@ virJSONValuePtr virJSONValueFromString(const char *jsonstring)
         goto cleanup;
     }
 
+    ret = parser.head;
+
 cleanup:
     yajl_free(hand);
 
@@ -930,7 +933,7 @@ cleanup:
 
     VIR_DEBUG("result=%p", parser.head);
 
-    return parser.head;
+    return ret;
 }