diff --git a/libgfortran/ChangeLog b/libgfortran/ChangeLog
index 20f3ebdc6a6..3a359e5059a 100644
--- a/libgfortran/ChangeLog
+++ b/libgfortran/ChangeLog
@@ -1,3 +1,11 @@
+2017-10-27  Jerry DeLisle  <jvdelisle@gcc.gnu.org>
+	    Rimvydas (RJ)
+
+	Backport from trunk
+	PR libgfortran/81938
+	io/format.c (free_format_data): Don't try to free vlist
+	descriptors past the end of the fnode array.
+
 2017-10-19  Thomas Koenig  <tkoenig@gcc.gnu.org>
 
 	Backport from trunk
diff --git a/libgfortran/io/format.c b/libgfortran/io/format.c
index bd14ac37bb3..c2abdd7b3af 100644
--- a/libgfortran/io/format.c
+++ b/libgfortran/io/format.c
@@ -266,7 +266,8 @@ free_format_data (format_data *fmt)
     return;
 
   /* Free vlist descriptors in the fnode_array if one was allocated.  */
-  for (fnp = fmt->array.array; fnp->format != FMT_NONE; fnp++)
+  for (fnp = fmt->array.array; fnp < &fmt->array.array[FARRAY_SIZE] &&
+       fnp->format != FMT_NONE; fnp++)
     if (fnp->format == FMT_DT)
 	{
 	  if (GFC_DESCRIPTOR_DATA(fnp->u.udf.vlist))