Created attachment 1388946 [details]
Experimental fixed SRPM for test

Description of problem:
Radius service crashes with "Bad talloc magic value - unknown value" when using module sql rlm_sql because of a double free of a talloc.

Version-Release number of selected component (if applicable):
freeradius-3.0.13-8

How reproducible:
With 

Steps to Reproduce:
1.The crash happens when the radius receives an accounting packet and the sql query does not match to any existing row in the accounting table, i.e. there is not a Start entry in the accounting table.
In the code, the talloc struct is freed 2 times in the loop and the finish part.

Actual results:
crash with :
rlm_sql_mysql: Rows matched: 0  Changed: 0  Warnings: 0
(8) sql: SQL query returned: success
(8) sql: 0 record(s) updated
(8) sql: Trying next query...
(8) sql: Ignoring null query
Bad talloc magic value - unknown value

talloc abort: Bad talloc magic value - unknown value

Expected results:
no crash

Additional info:
Patch :
--- 1/src/modules/rlm_sql/rlm_sql.c     2018-01-31 10:11:36.000000000 +0100
+++ 2/src/modules/rlm_sql/rlm_sql.c     2018-01-31 10:11:50.000000000 +0100
@@ -1439,7 +1439,6 @@
                if (!*expanded) {
                        RDEBUG("Ignoring null query");
                        rcode = RLM_MODULE_NOOP;
-                       talloc_free(expanded);

                        goto finish;
                }