Index: /trunk/src/auditd-event.c

===================================================================

--- /trunk/src/auditd-event.c	(revision 1420)

+++ /trunk/src/auditd-event.c	(revision 1421)

@@ -444,5 +444,8 @@

 void cleanup_event(struct auditd_event *e)

 {

-	free((void *)e->reply.message);

+	// Over in send_audit_event we sometimes have message pointing

+	// into the middle of the reply allocation. Check for it.

+	if (e->reply.message != e->reply.msg.data)

+		free((void *)e->reply.message);

 	free(e);

 }