diff --git a/editor/base/nsComposerCommands.cpp b/editor/base/nsComposerCommands.cpp
index 64f29a7f0085..1272bf0bdf77 100644
--- a/editor/base/nsComposerCommands.cpp
+++ b/editor/base/nsComposerCommands.cpp
@@ -475,7 +475,9 @@ nsRemoveListCommand::IsCommandEnabled(const PRUnichar *aCommand, nsISupports * r
     nsresult rv = editorShell->GetListState(&bMixed, &tagStr);
     if (NS_FAILED(rv)) return rv;
     
-    *outCmdEnabled = (*tagStr != nsnull);
+    *outCmdEnabled = (tagStr && *tagStr != nsnull);
+
+    if (tagStr) nsCRT::free(tagStr);
   }
   
   return NS_OK;
diff --git a/editor/composer/src/nsComposerCommands.cpp b/editor/composer/src/nsComposerCommands.cpp
index 64f29a7f0085..1272bf0bdf77 100644
--- a/editor/composer/src/nsComposerCommands.cpp
+++ b/editor/composer/src/nsComposerCommands.cpp
@@ -475,7 +475,9 @@ nsRemoveListCommand::IsCommandEnabled(const PRUnichar *aCommand, nsISupports * r
     nsresult rv = editorShell->GetListState(&bMixed, &tagStr);
     if (NS_FAILED(rv)) return rv;
     
-    *outCmdEnabled = (*tagStr != nsnull);
+    *outCmdEnabled = (tagStr && *tagStr != nsnull);
+
+    if (tagStr) nsCRT::free(tagStr);
   }
   
   return NS_OK;