double free via nm_check_database

I've seen this crash a dozen times or so this week sporadically, it often happens while Im away from the keyboard. Got a stacktrace here for you but haven't had time to investigate it further. Program terminated with signal 6, Aborted. #0 0x00007fc74834c475 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00007fc74834c475 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 #1 0x00007fc74834f6f0 in *__GI_abort () at abort.c:92 #2 0x00007fc74838626b in __libc_message (do_abort=<optimized out>, fmt=<optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189 #3 0x00007fc74838fab6 in malloc_printerr (action=3, str=0x7fc74846386a "free(): invalid pointer", ptr=<optimized out>) at malloc.c:6283 #4 0x00007fc7483947ec in *__GI___libc_free (mem=<optimized out>) at malloc.c:3738 #5 0x000000000046b171 in safe_free (ptr=0x7fff67bc6948) at lib.c:198 #6 0x000000000046b359 in mutt_str_replace (p=0x7fff67bc6948, s=0x23dcf5f "") at lib.c:286 #7 0x000000000043d37e in maildir_parse_flags (h=0x7fff67bc68c0, path=<optimized out>) at mh.c:596 #8 0x000000000047515a in nm_check_database (ctx=0x22ed250, index_hint=<optimized out>) at mutt_notmuch.c:1120 #9 0x000000000041c789 in mutt_index_menu () at curs_main.c:546 #10 0x00000000004061bd in main (argc=1, argv=0x7fff67bc7cf8) at main.c:1020 At mh.c:596 I see: (gdb) p h->maildir_flags $6 = 0x7fc7483e7aac "\205\300\017\224\300H\203\304H\017\266\300Ð\220\220\220\220\220\220\270V" (gdb) p p $7 = 0x23dcf5f "" .andy