A double free issue was discovered in radare2 in cmd_info.c:cmd_info(). Successful exploitation could lead to modification of unexpected memory locations and potentially causing a crash.
cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*
EEE8DA49-FB7A-4416-8942-56DD67E62CD9
4.4.0
OR
### Work environment

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | Ubuntu x86 64
| File format of the file you reverse (mandatory)      | ELF
| Architecture/bits of the file (mandatory)            | x86/64
| r2 -v full output, **not truncated** (mandatory)     | rradare2 4.3.1 23909 @ linux-x86-64 git.4.3.1-1-ge55661b commit: e55661bd4c229b9095982675709bdd52e1b4c068 build: 2020-03-22__22:18:20


### Expected behavior
Handle input error
### Actual behavior
double free/invalid pointer to free

### Steps to reproduce the behavior 
$ r2 -
[0x00000000]> in 0
[0x00000000]> oc 0
[0x00000000]> in 0
*** Error in `r2': free(): invalid pointer: 0x00007fffed1bcd00 ***
……

### Additional Logs, screenshots, source-code,  configuration dump, ...
![image](https://user-images.githubusercontent.com/20163299/77501626-880ca780-6e93-11ea-8669-48362438f409.png)
The `in` command would first free the original `core->table_query`, then create a new `core->table_query` in `cmd_info.c:cmd_info()`，
```
	R_FREE (core->table_query);
	if (space && *space == ' ') {
		core->table_query = r_str_trim_dup (space + 1);
	}
```
The `oc` command would free it in `core.c: r_core_fini`, which didn't NULL it out. 
```
……
	free (c->table_query);
	r_list_free (c->files);
	r_list_free (c->watchers);
	r_list_free (c->scriptstack);
……
```

So execute `in 0` again would cause a double/invalid free.

invalid free in  cmd_info.c:cmd_info()
This is a GitHub Issue
repo:radare2
owner:radareorg
Title : invalid free in  cmd_info.c:cmd_info()
Issue date:

--- start body ---
### Work environment

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | Ubuntu x86 64
| File format of the file you reverse (mandatory)      | ELF
| Architecture/bits of the file (mandatory)            | x86/64
| r2 -v full output, **not truncated** (mandatory)     | rradare2 4.3.1 23909 @ linux-x86-64 git.4.3.1-1-ge55661b commit: e55661bd4c229b9095982675709bdd52e1b4c068 build: 2020-03-22__22:18:20


### Expected behavior
Handle input error
### Actual behavior
double free/invalid pointer to free

### Steps to reproduce the behavior 
$ r2 -
[0x00000000]> in 0
[0x00000000]> oc 0
[0x00000000]> in 0
*** Error in `r2': free(): invalid pointer: 0x00007fffed1bcd00 ***
……

### Additional Logs, screenshots, source-code,  configuration dump, ...
![image](https://user-images.githubusercontent.com/20163299/77501626-880ca780-6e93-11ea-8669-48362438f409.png)
The `in` command would first free the original `core->table_query`, then create a new `core->table_query` in `cmd_info.c:cmd_info()`，
```
	R_FREE (core->table_query);
	if (space && *space == ' ') {
		core->table_query = r_str_trim_dup (space + 1);
	}
```
The `oc` command would free it in `core.c: r_core_fini`, which didn't NULL it out. 
```
……
	free (c->table_query);
	r_list_free (c->files);
	r_list_free (c->watchers);
	r_list_free (c->scriptstack);
……
```

So execute `in 0` again would cause a double/invalid free.

--- end body ---

comments :
--- start comments ---

--- end comments ---