Description of problem:
A double free and a double close are present in alsabat (part of alsa-utils).

Version-Release number of selected component (if applicable):
alsa-utils in version 1.1.2

How reproducible:
Found statically, no test-case provided.

Steps to Reproduce:
In the file bat/asla.c, the function record_alsa (line 663): there is a call to free on sndpcm.buffer, at line 693:

    pthread_cleanup_push(free, sndpcm.buffer);

Another call to free on the same variable is possible at line 715:

exit3:

   free(sndpcm.buffer);

The presence of a "goto exit 3", right after the first free makes such path possible. 
Notice that in the same way, a double close can be achieved on sndpcm.handle (yet the double free seems more dangerous).

Actual results:


Expected results:

Additional info:
A fix could be to set sndpcm.buffer (resp. sndpcm.handle) to a NULL value after the first free (resp. close), and to check its value before the second call.