Lighttpd

http://redmine.lighttpd.net/repositories/entry/lighttpd/branches/lighttpd-1.4.x/src/mod_accesslog.c

Function:
int accesslog_parse_format(server *srv, format_fields *fields, buffer *format)

Line 172:
fields->ptr = malloc(fields->size * sizeof(format_fields * ));
should be
fields->ptr = malloc(fields->size * sizeof(format_field * ));
Line 175:
fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_fields * ));
should be
fields->ptr = realloc(fields->ptr, fields->size * sizeof(format_field * ));

They are all pointers, so it may be not so serious. But
Line 178:
fields->ptr[fields->used] = malloc(sizeof(format_fields));
should be
fields->ptr[fields->used] = malloc(sizeof(format_field));

Lighttpd runs ok because format_field and format_fields are the same size.

If I was right. It happened many times below in this function.