Fix unsafe string handling in configs

Also fixes 2 leaks