Fixed double-free with multiple SUBSCRIBE channels.

client.c

@@ -252,13 +252,15 @@ http_client_read(struct http_client *c) {
 
 		/* disconnect pub/sub client if there is one. */
 		if(c->pub_sub && c->pub_sub->ac) {
-			/*
-			printf("client disconnected (cmd=%p), ac=%p\n",
-				(void*)c->pub_sub, (void*)c->pub_sub->ac);
-			*/
+			struct cmd *cmd = c->pub_sub;
+
+			/* disconnect from all channels */
 			redisAsyncDisconnect(c->pub_sub->ac);
 			if(c->pub_sub) c->pub_sub->ac = NULL;
 			c->pub_sub = NULL;
+
+			/* delete command object */
+			cmd_free(cmd);
 		}
 
 		close(c->fd);

formats/common.c

@@ -46,8 +46,9 @@ format_send_error(struct cmd *cmd, short code, const char *msg) {
 	/* for pub/sub, remove command from client */
 	if(cmd->pub_sub_client) {
 		cmd->pub_sub_client->pub_sub = NULL;
+	} else {
+		cmd_free(cmd);
 	}
-	cmd_free(cmd);
 }
 
 void