[1.7.x] out of bounds read?

valgrind says

==18827== Invalid read of size 4
==18827==    at 0x808C04D: str_lwr (string.c:257)
==18827==    by 0x8090295: wildmat (wildmat.c:148)
==18827==    by 0x804C789: match_group_list (active.c:817)
==18827==    by 0x805BD08: filter_articles (filter.c:2152)
==18827==    by 0x804F448: index_group (art.c:477)
==18827==    by 0x805E61C: group_page (group.c:169)
==18827==    by 0x808A5A7: read_groups (select.c:1037)
==18827==    by 0x808AA9D: selection_page (select.c:220)
==18827==    by 0x806BC23: main (main.c:395)
==18827==  Address 0x1C86F61F is 15 bytes inside a block of size 18 alloc'd
==18827==    at 0x1B90459D: malloc (vg_replace_malloc.c:130)
==18827==    by 0x806C595: my_malloc1 (memory.c:488)
==18827==    by 0x808BF8A: my_strdup (string.c:131)
==18827==    by 0x809028D: wildmat (wildmat.c:147)
==18827==    by 0x804C789: match_group_list (active.c:817)
==18827==    by 0x805BD08: filter_articles (filter.c:2152)
==18827==    by 0x804F448: index_group (art.c:477)
==18827==    by 0x805E61C: group_page (group.c:169)
==18827==    by 0x808A5A7: read_groups (select.c:1037)
==18827==    by 0x808AA9D: selection_page (select.c:220)
==18827==    by 0x806BC23: main (main.c:395)

and efence dies in str_lwr()

#3  <signal handler called>
#4  0x0808c04d in str_lwr (str=0xb46cbffd "") at ./string.c:257
#5  0x08090296 in wildmat (text=0xb5419fec "hamburg.allgemein", 
    p=0xbfffa358 "de.alt.test", icase=1) at ./wildmat.c:148
#6  0x0804c78a in match_group_list (group=0xb5419fec "hamburg.allgemein", 
    group_list=0xb527aff4 "de.alt.test") at ./active.c:817
#7  0x0805bd09 in filter_articles (group=0xb71f0de0) at
./filter.c:2152
#8  0x0804f449 in index_group (group=0xb71f0de0) at ./art.c:477
#9  0x0805e61d in group_page (group=0xb71f0de0) at ./group.c:169
#10 0x0808a5a8 in read_groups () at ./select.c:1037
#11 0x0808aa9e in selection_page (start_groupnum=110, num_cmd_line_groups=0)
    at ./select.c:220
#12 0x0806bc24 in main (argc=1, argv=0xbffff634) at ./main.c:395

but I don't see the problem in the code (which runs fine when not in
a leak-tracer) - can anyone else see what's wrong here?