PerlXS: Possible crash trying to free()

Question

I am seeing subtle crashes, which I think is down to the following XS code:

void
tiff_ReadRawStrip (tif, strip, size)
            TIFF            *tif
            uint32_t        strip
            tmsize_t        size
INIT:
            void            *buf;
            tmsize_t        stripsize, bufsize;
PPCODE:
            stripsize = TIFFStripSize(tif);
            buf = (unsigned char *)_TIFFmalloc(stripsize);
            bufsize = TIFFReadRawStrip(tif, strip, buf, size);
            if (bufsize > 0) {
                XPUSHs(sv_2mortal(newSVpvn(buf, bufsize)));
            }
            _TIFFfree(buf);

Am I trying to free buf twice? Is there something else going on?

Background info

Some years ago, I wrote Graphics::TIFF - Perl bindings for libtiff and have been using them successfully in various other Linux-based projects. More recently, I got them to compile on Windows in Github actions.

Now a project using Graphics::TIFF is seeing random crashes on Windows during unit testing, which seem to be caused by Graphics::TIFF. I can only reproduce them in Github actions, as I don't have access to a Windows machine.

The Linux runners pass with no problems, so perhaps the Windows compiler is less forgiving about something.