UCS: ucs_config_parser_set_value on incorrect value leads segmentation fault (double free)

[hoopoepg]

Describe the bug

ucs_config_parser_set_value on incorrect value leads segmentation fault (double free)

Steps to Reproduce

reproducer below

Additional information (depending on the issue)

reproduced on master

reproducer:

#include <ucs/config/parser.h>
#include <assert.h>

typedef enum {
    TEST_TYPE_1,
    TEST_TYPE_2,
    TEST_TYPE_ALL,
    TEST_TYPE_LAST,
} test_type_t;

const char *test_type_names[] = {
    [TEST_TYPE_1] = "type_1",
    [TEST_TYPE_2] = "type_2",
    [TEST_TYPE_ALL] = "all",
    [TEST_TYPE_LAST] = NULL
};

typedef struct test_config {
    struct {
        test_type_t *types;
        unsigned     count;
    } field;
} test_config_t;

UCS_CONFIG_DEFINE_ARRAY(test_types, sizeof(test_type_t),
                        UCS_CONFIG_TYPE_ENUM(test_type_names));
static ucs_config_field_t table[] = {
    {"TEST", "all", "Comma separated list types",
     ucs_offsetof(test_config_t, field), UCS_CONFIG_TYPE_ARRAY(test_types)},
    {NULL}
};

int main(int argc, char *argv[])
{
    ucs_status_t status;

    test_config_t *cfg = malloc(sizeof(*cfg));
    ucs_config_parser_fill_opts(cfg, table, "prefix", NULL, 0);
    status = ucs_config_parser_set_value(cfg, table, "TEST", "type_1,type_2");
    assert(UCS_OK == status);
    status = ucs_config_parser_set_value(cfg, table, "TEST", "type_3");
    assert(UCS_OK != status);
    ucs_config_parser_release_opts(cfg, table); /* here is double free issue */
    free(cfg);
    return 0;
}