static int l_userauth_publickey (lua_State *L) {
    return userauth_publickey(L, 0, 0);
}

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.