pkg.c scan_dir() has:

#define EXT_LEN 3
[...]
      int len = strlen (dent->d_name);
[...]
          char *pkgname = g_malloc (len - 2);
[...]
	  strncpy (pkgname, dent->d_name, len - EXT_LEN);
          pkgname[len-EXT_LEN] = '\0';

The goal is for pkgname to hold the name without the trailing ".pc" extension (according to the meaning of EXT_LEN as used in the ends_in_dotpc() function). But the malloc is hardcoded as 2. If the extension were to be changed, the number of characters being strncpy'ed would not match the size of the target buffer. Instead, the malloc should use the EXT_LEN token (adjusted for the trailing \0)