There seems to be a memory leak in stringbuf.c:sbuf_split_at(). The function returns without freeing "res" if "pos" is negative.