Re: simple valgrind test found what appear to be serious memory problems

    How does one go about such an audit?

One approach that would cover a lot of ground is a comprehensive test
suite.  Yes, that will take a lot of effort to create -- probably more
than writing the code.  On the other hand, without test suites, I can't
think of any way to be confident that major bugs have not been
introduced.  Especially when you've rewritten essentially the entire
program (I confess I wasn't aware of this), double especially when new
memory management is involved.

Another idea would be to forget the complete rewrite for a time
and do a "minimal" update of the infrastructure files, switching to
GPLv3, and other such non-invasive changes.  That sort of new release is
unlikely to be problematic.

Best,
k

P.S. I recommend staying away from obstacks.  As Paul said, everyone
understands malloc/free, while few people are familiar with obstacks.  I
assert without proof (but with confidence :) that any performance
difference is vanishingly small compared to, say, file I/O operations.