Fix a NULL deref in an error path