You did not implement a copy constructor, so default one is called when you return by value from multiplication function.
Default constructor simply copies members byte-wise, so you end up having two matrices containing mdata that is pointing to the same memory block. When destructor for second matrix is called, it is trying to free memory that was already freed, hence the error.
Of course, plus what other people pointed out about delete [].
In general, you should follow rule of three. Applied to your case, it would mean that if you do anything non-trivial in destructor, you should either explicitly implement assignment operator and copy constructor, or declare them private and not implement them to avoid automatic compiler generated ones and make class non-copyable.