Comment 2 for bug 70710

According to crash file:

Running under edgy (2.6.17 kernel)
Package version: 21.4a-6ubuntu2

Crash appears to occur within a call to sprintf(). A bad string argument was probably passed to it, as it dies within a strlen() call that sprintf() invoked.
Looking through the source for format strings that are either dynamically generated or include the %s specifier, and that might be called during or after a write attempt, might be illuminating.