free_char double free or corruption crash [Apr 28 00:10]

[rabidt]

Binary built at commit d095ae6

syslog

Apr 28 00:10:09 :: SYSERR: NULL object (0x231a8a50) or same source (0x231a8a50) and target ((nil)) obj passed to obj_to_obj.
*** Error in `circle': double free or corruption (!prev): 0x00000000067575d0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x77e15)[0x7f7ee4190e15]
/lib64/libc.so.6(+0x8041a)[0x7f7ee419941a]
/lib64/libc.so.6(cfree+0x4c)[0x7f7ee419cbcc]
circle[0x4b071d]
circle[0x581e03]
circle[0x403aea]
/lib64/libc.so.6(__libc_start_main+0xf0)[0x7f7ee4139580]
circle[0x403fc9]

GDB bt

Core was generated by `circle -C3 4100'.
Program terminated with signal 6, Aborted.
#0  0x00007f7ee414da98 in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: debuginfo-install MariaDB-shared-10.1.44-1.el7.centos.x86_64 bzip2-libs-1.0.6-13.el7.x86_64 expat-2.1.0-10.el7_3.x86_64 fontconfig-2.13.0-4.3.el7.x86_64 freetype-2.8-14.el7.x86_64 gd-2.0.35-26.el7.x86_64 glibc-2.22-3.fc23.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.15.1-37.el7_7.2.x86_64 libX11-1.6.7-2.el7.x86_64 libXau-1.0.8-2.1.el7.x86_64 libXpm-3.5.12-1.el7.x86_64 libcom_err-1.42.9-16.el7.x86_64 libgcc-5.1.1-4.fc23.x86_64 libjpeg-turbo-1.2.90-8.el7.x86_64 libpng-1.5.13-7.el7_2.x86_64 libselinux-2.5-14.1.el7.x86_64 libstdc++-5.1.1-4.fc23.x86_64 libuuid-2.23.2-61.el7_7.1.x86_64 libxcb-1.13-1.el7.x86_64 nss-softokn-freebl-3.44.0-8.el7_7.x86_64 openssl-libs-1.0.2k-19.el7.x86_64 pcre-8.32-17.el7.x86_64 zlib-1.2.8-9.fc23.x86_64
(gdb) bt
#0  0x00007f7ee414da98 in raise () from /lib64/libc.so.6
#1  0x00007f7ee414f69a in abort () from /lib64/libc.so.6
#2  0x00007f7ee4190e1a in __libc_message () from /lib64/libc.so.6
#3  0x00007f7ee419941a in _int_free () from /lib64/libc.so.6
#4  0x00007f7ee419cbcc in free () from /lib64/libc.so.6
#5  0x0000000000601c61 in free_char (ch=<optimized out>) at db.c:4877
#6  0x00000000004b064c in extract_char_final (ch=<optimized out>) at handler.c:2088
#7  0x00000000004b071d in extract_pending_chars () at handler.c:2151
#8  0x000000000058113e in heartbeat (heart_pulse=<optimized out>) at comm.c:1172
#9  0x0000000000581e03 in game_loop (local_mother_desc=3) at comm.c:1031
#10 0x0000000000403aea in init_game (local_port=<optimized out>) at comm.c:580
#11 main (argc=<optimized out>, argv=<optimized out>) at comm.c:385

[rabidt]

Further occurrences at at Apr 28 07:11 and Apr 28 07:48 with binary built on 1b43c58