Why the SEGFAULT in this code?

Can someone tell me why the code below should segfault at the line
indicated?

Also, why does strtok_r() require a **ptrptr and not a *ptr?
(Maybe this is a clue to my problem and misunderstanding of how strtok_r
is used...).

Thanks for any insight.

-Randy

PS: str arg is always guaranteed to point to a valid string < 127 chars


void getNameValuePairFromString(char * str, string & name, string & value)
{
char * buf = (char *) malloc(128);
char * tok = strtok_r(str, " =\n\r", &buf);
if (tok != NULL)
{
name = tok;
tok = strtok_r(NULL, " =\n\r", &buf);
if (tok != NULL)
value = tok;
}
free(buf); // seg fault here !!!
}