double free in hfd

gistfile1.txt

edd-i386% `pwd`/hgd-playd -Bx2                            
[info - 00001418 cfg.c:hgd_load_config():32]
        Trying to read config from - /home/edd/.config/hgd/hgd.rc
hgd-playd in free(): error: bogus pointer (double free?) 0x511f9c
zsh: abort (core dumped)  `pwd`/hgd-playd -Bx2
edd-i386% gdb /home/edd/source/hgd/hgd-playd     
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-unknown-openbsd5.0"...
(gdb) run -Bx2
Starting program: /home/edd/source/hgd/hgd-playd -Bx2
[info - 00009856 cfg.c:hgd_load_config():32]
        Trying to read config from - /home/edd/.config/hgd/hgd.rc
hgd-playd in free(): error: bogus pointer (double free?) 0x511f9c

Program received signal SIGABRT, Aborted.
[Switching to process 9856, thread 0x206687800]
0x000000020be4f30a in kill () from /usr/lib/libc.so.60.1
(gdb) bt
#0  0x000000020be4f30a in kill () from /usr/lib/libc.so.60.1
#1  0x000000020beb1121 in abort () at /usr/src/lib/libc/stdlib/abort.c:68
#2  0x000000020beaec27 in wrterror (msg=Variable "msg" is not available.
) at /usr/src/lib/libc/stdlib/malloc.c:269
#3  0x000000020beb015d in free (ptr=0x511f9c) at /usr/src/lib/libc/stdlib/malloc.c:1216
#4  0x000000000040e227 in hgd_cfg_daemonise (cf=0x7f7ffffc30b0, service=0x511f9c "playd", 
    background=0x6133d4) at cfg.c:74
#5  0x000000000040e9bb in hgd_read_config (config_locations=Variable "config_locations" is not available.
) at hgd-playd.c:138
#6  0x000000000040f20c in main (argc=2, argv=0x7f7ffffc31c0) at hgd-playd.c:225

(gdb) list hgd-playd.c:138
133
134 if (hgd_load_config(cf, config_locations) == HGD_FAIL) {
135 return (HGD_OK);
136 }
137
138 hgd_cfg_daemonise(cf, "playd", &background);
139 hgd_cfg_statepath(cf, &state_path);
140 hgd_cfg_playd_purgefs(cf, &purge_finished_fs);
141 #ifdef HAVE_PYTHON
142 hgd_cfg_pluginpath(cf, &hgd_py_plugin_dir);
(gdb) list hgd_cfg_daemonise
57 }
58 }
59
60 void
61 hgd_cfg_daemonise(config_t cf, char service, int* background)
62 {
63 /* -B */
64 int tmp_background;
65 char *lookup;
66
(gdb)
67 xasprintf(&lookup, "%s:daemonise", service);
68
69 if (config_lookup_bool(cf, service, &tmp_background)) {
70 *background = tmp_background;
71 DPRINTF(HGD_D_DEBUG, "%s to background daemon",
72 *background ? "Going" : "Not going");
73 }
74 if (service != NULL) free(service);
75 }
76