Double-free bug in bash for env vars

[Tilghman Lesher]

Configuration Information [Automatically generated, do not change]:
Machine: i586
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i586' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i586-mandrake-linux-gnu' 
-DCONF_VENDOR='mandrake' -DSHELL -DHAVE_CONFIG_H  -D_GNU_SOURCE 
-D_FILE_OFFSET_BITS=64  -I. -I. -I./include -I./lib -I/usr/include 
-O3 -fomit-frame-pointer -pipe -mcpu=pentiumpro -march=i586 
-ffast-math -fno-strength-reduce
uname output: Linux vcch21.vcch.int 2.4.18-6mdk #1 Fri Mar 15 02:59:08 
CET 2002 i686 unknown unknown GNU/Linux
Machine Type: i586-mandrake-linux-gnu

Bash Version: 2.05
Patch Level: 1
Release Status: release

Description:
        Bash died with a mysterious message, apparently a double-free bug,
        when setting the environmental variable TERM multiple times in a
        session.  I generally have to switch between TERM=linux and
        TERM=vt100, depending on which applications I'm using at the time.
        TERM=linux is useful for most applications, such as vim and ls, while
        the Informix database tools do not recognize the linux terminal and
        must use something like vt100.

Repeat-By:
        [tlvcch@vcch21 vcch]$ export TERM=vt100
        [tlvcch@vcch21 vcch]$ export TERM=linux
        [tlvcch@vcch21 vcch]$ export TERM=vt100
        [tlvcch@vcch21 vcch]$ export TERM=linux
        [tlvcch@vcch21 vcch]$ export TERM=vt100
        [tlvcch@vcch21 vcch]$ export TERM=linux
        [tlvcch@vcch21 vcch]$ export TERM=vt100
        [tlvcch@vcch21 vcch]$ export TERM=linux
        free: called with already freed block argument
        last command: export TERM=linux
        Stopping myself...Connection to vcch21 closed.