snipped some lines
    FontData font_data = Xcalloc(count, sizeof(FontDataRec));
    for ( ; count-- > 0; font_data++) {
        font_data->name = Xmalloc(len + 1);
        if (font_data->name == NULL) {
            Xfree(font_data);
            return NULL;
        }

if count>0 and Xmalloc(len + 1) fails after first for loop, free() is called on invalid pointer (malloc()ed ptr font_data offset by 280 bytes on my system).
did you mean to Xfree(ret) ?  you also leak the other successful font_data->name malloc()s doing this.