Leaking function... Second opinion?

[Vertigo]

I've been looking at a piece of code for a couple of days now that
appears to be 
leaking memory.  I'd just like another opinion it to see what it is I'm
not 
seeing.  It's tied into my do_look routine and splices two strings
together 
using getline OLC 1.81's standard getline and other standard functions.
I'm
just thinking something isn't being freed correctly.  What is happening
is
I'm getting an increase in perms by two every single time the character 
'looks'.  Which is equivalent to the amount of strings I'm sending to
this
piece of code.  The other two strings display fine with no leak on their
own
so I've pretty much deduced that this one is the culprit.

Vert


Attached below:
[Snip]

char *insert_string( const char *oldstring, char *insert )
{
   char formatted[MSL];
   char *tempstr, *therest;
   char templine[MSL], newstr[MSL];
   char temp1[MSL], temp2[MSL];
   bool mapbigger = TRUE;
   bool cap = FALSE;
   int line= 0, i=0;
   
   tempstr = str_dup(oldstring);
   
   tempstr = format_string2( tempstr, 72, FALSE ); 
   /* format it to minus the map */
   
   newstr[0] = '\0';
   
   while( *insert || *tempstr )
   {
      if( *tempstr && !(*insert) )
                mapbigger = FALSE;
      
      insert = getline(insert, temp1); /*gets first line of map */
      
      tempstr = getline(tempstr, temp2); /*get first line of desc*/
      
      sprintf(templine, "%s %s{x\n\r", temp1, temp2);
      
      strcat(newstr, templine);
   }
   
   if(!mapbigger)
   {
      for(tempstr = newstr;;)
      {
         formatted[i++] = *tempstr;
         if(*(tempstr++) == '\r')
         {
            if(++line > 6)
              break;
         }
   }
      
      formatted[i] = '\0';
      
      if(is_end_punct(formatted[i-3]))
                cap = TRUE;
      
      therest = str_dup(tempstr);
      
      therest = format_string2(therest, 79, FALSE );
      
      if(!cap)
        *therest = LOWER(*therest); 
      
      strcat(formatted,therest);

   free_string(tempstr);
   free_string(therest);
   free_string(templine);
   free_string(temp1);
   free_string(temp2);
         
      return str_dup(formatted);
      free_string(formatted);
   }
   else
     return str_dup(newstr);
        free_string(newstr);
}