the problem is you're calling config_destroy. That loses all your data allocated during lookups..
— Function: void config_destroy (config_t * config) These functions initialize and destroy the configuration object config.
config_init() initializes the config_t structure pointed to by config as a new, empty configuration.
config_destroy() destroys the configuration config, deallocating all memory associated with the configuration, but does not attempt to deallocate the config_t structure itself.
Pretty sure on this.
Try getting rid of that line and see what happens.
More: When libconfig allocates memory for the pointers you pass in, it has to keep the memory references around somewhere so it can clean them up later. That's what the cfg object is. It's just a big record keeping object for everything the library has allocated. When you destroy it, the library must free all allocated memory or else it will be leaked forever.