The call "bson_free( cursor->reply );" is invalid, since mongo_cursor_destroy() destroys the reply as well, and the reply field is used a few lines down.

Patch:

diff --git a/src/mongo.c b/src/mongo.c
index c8df093..2673e7f 100644
— a/src/mongo.c
+++ b/src/mongo.c
@@ -1269,7 +1269,6 @@ static int mongo_cursor_get_more( mongo_cursor *cursor ) {
data = mongo_data_append32( data, &limit );
mongo_data_append64( data, &cursor->reply->fields.cursorID );

• bson_free( cursor->reply );
  res = mongo_message_send( cursor->conn, mm );
  if( res != MONGO_OK ) {
  mongo_cursor_destroy( cursor );