static void* OGRExpatRealloc( void *ptr, size_t size )
{
    if( CanAlloc(size) )
        return realloc(ptr, size);

    free(ptr);
    return nullptr;
}
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.