> Here is a follow-up on my earlier patch.  I found a couple of other 
> instances of potential double freeing in the same routine.

You wouldn't have a test case - at least something that causes this code 
to go through the motions?  That way on systems with pedantic memory 
managers there'd bee some sort of error.

Anyway, I've committed the attached (slightly tweaked).

Andrew