Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wow, that's embarrassing, how did I miss that.

I think what happened is at one point the blocksums were an unsized array at the end of the rs_signature_t instead of a separate allocation, and thus didn't need it's own free.

This is a good catch, but your fix is slightly wrong... you need to do the free before the sig is zeroed, otherwise you are just freeing a null pointer, which is a no-op.