A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. https://nvd.nist.gov/vuln/detail/CVE-2018-6952