Valgrind reports this:

==7808== 672 bytes in 8 blocks are definitely lost in loss record 4 of 12
==7808==    at 0x4004F52: malloc (vg_replace_malloc.c:149)
==7808==    by 0x41191F5: g_malloc (gmem.c:131)
==7808==    by 0x4116149: g_markup_parse_context_new (gmarkup.c:132)
==7808==    by 0x44883D1: ???
==7808==    by 0x448A204: ???
==7808==    by 0x448A2C0: ???
==7808==    by 0x4484D7A: ???
==7808==    by 0x401D47D: gconf_sources_all_entries (gconf-sources.c:210)
==7808==    by 0x804C165: gconf_database_all_entries (gconf-database.c:1617)
==7808==    by 0x804DD4F: impl_ConfigDatabase2_all_entries_with_schema_name (gconf-database.c:618)
==7808==    by 0x402C17C: _ORBIT_skel_small_ConfigDatabase2_all_entries_with_schema_name (GConfX-common.c:112)
==7808==    by 0x4066C56: ORBit_POAObject_invoke (poa.c:1145)
==7808==    by 0x406CDB4: ORBit_OAObject_invoke (orbit-adaptor.c:336)
==7808==    by 0x4059E66: ORBit_small_invoke_adaptor (orbit-small.c:835)
==7808==    by 0x406AA3D: ORBit_POAObject_handle_request (poa.c:1354)
==7808==    by 0x406B0E1: ORBit_POAObject_invoke_incoming_request (poa.c:1422)
==7808==    by 0x406BB52: ORBit_POA_handle_request (poa.c:1644)
==7808==    by 0x406CF51: ORBit_handle_request (orbit-adaptor.c:296)
==7808==    by 0x4056236: giop_connection_handle_input (giop-recv-buffer.c:1282)
==7808==    by 0x4073AFC: link_connection_io_handler (linc-connection.c:1367)
==7808==    by 0x40768CD: link_source_dispatch (linc-source.c:159)
==7808==    by 0x4111BCC: g_main_context_dispatch (gmain.c:1916)
==7808==    by 0x4114E4E: g_main_context_iterate (gmain.c:2547)
==7808==    by 0x41151F8: g_main_loop_run (gmain.c:2751)
==7808==    by 0x8051881: main (gconfd.c:934)

Looking at the code I see the only place g_markup_parse_context_new() is called is in the parse_tree() function.

There's a call to g_markup_parse_context_free() but that's not being called in the error case. Maybe that call should be moved into the out: label?