Failure INSIDE malloc() ??

[Lars S. Nyland]

I have found over the years that failures that appear to
be inside of malloc() usually have to do with corrupt data
structures.  How do they get corrupted?  Not by malloc, not
usually anyway.

Usually, like many other bugs in C, some pointer has gone
astray, and you have used it, assigned values to its location,
and ruined malloc's data structures.

I would bet that you still use a pointer after you have freed
the memory it points to.  You might amend your free statements
to be more like:
	free(p); p = NULL;
just to make sure that you don't use the pointers after you have
freed them.