Invalid free in r_strbuf_fini()

[fumfel]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Ubuntu 16.04 x64
File format of the file you reverse (mandatory)	ELF
Architecture/bits of the file (mandatory)	x86-64
r2 -v full output, not truncated (mandatory)	radare2 2.6.0-git 17980 @ linux-x86-64 git.2.5.0-109-g4f83f9c commit: 4f83f9c build: 2018-04-23__12:43:37

Expected behavior

Display dissaslembly of file or error message.

Actual behavior

Invaild free and program crash.

Steps to reproduce the behavior

• Download: https://github.com/radare/radare2-regressions/pull/1284
• Run r2 -A r2_if_r_strbuf_fini

Additional Logs, screenshots, source-code, configuration dump, ...

Backtrace & error message:

*** Error in `r2': free(): invalid pointer: 0x00007fcc0a02bc90 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fcc095197e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7fcc0952237a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fcc0952653c]
/usr/local/lib/libr_util.so(r_strbuf_fini+0x97)[0x7fcc09d5bb27]
/usr/local/lib/libr_anal.so(+0xecac2)[0x7fcc0c835ac2]
/usr/local/lib/libr_anal.so(+0xef72c)[0x7fcc0c83872c]
/usr/local/lib/libr_anal.so(+0xeebe0)[0x7fcc0c837be0]
/usr/local/lib/libr_anal.so(r_anal_op+0x296)[0x7fcc0c935636]
/usr/local/lib/libr_core.so(r_core_anal_search_xrefs+0x4e8)[0x7fcc0e4434c8]
/usr/local/lib/libr_core.so(r_core_anal_refs+0x58d)[0x7fcc0e2c4a5d]
/usr/local/lib/libr_core.so(+0xa014e)[0x7fcc0e2f614e]
/usr/local/lib/libr_core.so(r_cmd_call+0x4d4)[0x7fcc0e42c3c4]
/usr/local/lib/libr_core.so(+0x8067e)[0x7fcc0e2d667e]
/usr/local/lib/libr_core.so(r_core_cmd+0x865)[0x7fcc0e2cdb65]
r2(+0x9a10)[0x5598e508ea10]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fcc094c2830]
r2(+0x3749)[0x5598e5088749]

Extract from Valgrind log:

==847== Invalid free() / delete / delete[] / realloc()
==847==    at 0x4C2EDEB: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==847==    by 0x9800B26: r_strbuf_fini (strbuf.c:158)
==847==    by 0x65CAAC1: _inst(char, short *,...) (anal_avr.c:630)
==847==    by 0x65CD72B: avr_op_analyze (anal_avr.c:1564)
==847==    by 0x65CCBDF: avr_op (anal_avr.c:1642)
==847==    by 0x66CA635: r_anal_op (op.c:104)
==847==    by 0x522B4C7: r_core_anal_search_xrefs (canal.c:2820)
==847==    by 0x50ACA5C: r_core_anal_refs (cmd_anal.c:5950)
==847==    by 0x50DE14D: cmd_anal_all (cmd_anal.c:6335)
==847==    by 0x50DE14D: cmd_anal (cmd_anal.c:6679)
==847==    by 0x52143C3: r_cmd_call (cmd_api.c:233)
==847==    by 0x50BE67D: r_core_cmd_subst_i (cmd.c:2686)
==847==    by 0x50BE67D: r_core_cmd_subst (cmd.c:1733)
==847==    by 0x50B5B64: r_core_cmd (cmd.c:3376)
==847==  Address 0x9ad0c90 is 3584 bytes inside data symbol "sdb_fmt.Key"