"double free or corruption" on network setup (UPnP)

[schnittchen]

Pidgin crashes with
*** glibc detected *** pidgin: double free or corruption (fasttop): 0x084fb428 ***
(see below). This bug is UPnP-related! I'm working behind a NAT router, disabling UPnP will make it work. With UPnP enabled, the bug is 100% reproducable for me.

Here a (snipped) output of pidgin -n -d:

(16:13:10) Session Management: ICE initialized.
(16:13:10) Session Management: Connecting with no previous ID
(16:13:10) Session Management: Handling new ICE connection...
(16:13:10) done.
(16:13:10) Session Management: Connected to manager (GnomeSM) with client ID 117f000101000121405759000000064910034
(16:13:10) Session Management: Using pidgin as command
(16:13:10) gtkspell: Failed to setup GtkSpell: aspell: No word lists can be found for the language "de_DE".
(16:13:10) dbus: Need to register an object with the dbus subsystem. (If you are not a developer, please ignore this message.)
(16:13:10) dbus: The signal "gtkblist-unhiding" caused some dbus error. (If you are not a developer, please ignore this message.)
(16:13:10) util: requested to fetch (http://192.168.1.1:5431/dyndev/uuid:001c-10a2-d81000009adc), full=1, user_agent=((null)), http11=1
(16:13:10) proxy: Gnome proxy settings are set to 'manual' but no proxy server is specified. Using Pidgin's proxy settings instead.
(16:13:10) dns: DNS query for '192.168.1.1' queued
(16:13:10) dnssrv: found 0 SRV entries
(16:13:10) stun: got 0 SRV responses, server: stun.sipgate.de, port: 3478
(16:13:10) dns: DNS query for 'stun.sipgate.de' queued
(16:13:10) Session Management: Received first save_yourself
(16:13:10) dns: Created new DNS child 18232, there are now 1 children.
(16:13:10) dns: Successfully sent DNS request to child 18232
(16:13:10) dns: Created new DNS child 18233, there are now 2 children.
(16:13:10) dns: Successfully sent DNS request to child 18233
(16:13:10) Session Management: Received save_complete
(16:13:10) dns: Got response for '192.168.1.1'
(16:13:10) dnsquery: IP resolved for 192.168.1.1
(16:13:10) proxy: Attempting connection to 192.168.1.1
(16:13:10) proxy: Connecting to 192.168.1.1:5431 with no proxy
(16:13:10) proxy: Connection in progress
(16:13:10) proxy: Connected to 192.168.1.1:5431.
(16:13:10) util: Request: 'GET /dyndev/uuid:001c-10a2-d81000009adc HTTP/1.1
Connection: close
Host: 192.168.1.1:5431

'
(16:13:10) docklet: embedded
(16:13:10) util: Response headers: 'HTTP/1.0 200 OK
SERVER: LINUX/2.4 UPnP/1.0 BRCM400/1.0
DATE: Sat, 21 Jun 2008 16:11:56 GMT
CONTENT-TYPE: application/octet-stream
Cache-Control: max-age=1
PRAGMA: no-cache
Connection: Close

'
(16:13:10) util: requested to fetch (http://192.168.1.1:5431/uuid:001c-10a2-d81002009adc/WANIPConnection:1), full=0, user_agent=((null)), http11=1
*** glibc detected *** pidgin: double free or corruption (fasttop): 0x084fb428 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb760ca85]
/lib/tls/i686/cmov/libc.so.6(cfree+0x90)[0xb76104f0]
/usr/lib/libglib-2.0.so.0(g_free+0x31)[0xb776d8b1]
/usr/lib/libpurple.so.0[0xb788772f]
/usr/lib/libpurple.so.0(purple_proxy_get_setup+0x92)[0xb788b22c]
/usr/lib/libpurple.so.0(purple_proxy_connect+0x10f)[0xb788b57a]
/usr/lib/libpurple.so.0(purple_util_fetch_url_request+0x1b7)[0xb78b01fe]
/usr/lib/libpurple.so.0[0xb78a0317]
/usr/lib/libpurple.so.0[0xb78a0551]
/usr/lib/libpurple.so.0[0xb789f949]
/usr/lib/libpurple.so.0[0xb78afbf7]
pidgin[0x80abca3]
/usr/lib/libglib-2.0.so.0[0xb7799c5d]
/usr/lib/libglib-2.0.so.0(g_main_context_dispatch+0x178)[0xb7765bf8]
/usr/lib/libglib-2.0.so.0[0xb7768e5e]
/usr/lib/libglib-2.0.so.0(g_main_loop_run+0x1e7)[0xb77691e7]
/usr/lib/libgtk-x11-2.0.so.0(gtk_main+0xb4)[0xb7c27264]
pidgin(main+0xbbc)[0x80c70d5]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe0)[0xb75b7450]
pidgin[0x806c821]

(omitted memory map and various initial setup debug messages)

Note that https://bugs.launchpad.net/ubuntu/+source/pidgin/+bug/184796 shows a completely different stack trace.

[Pedro Villavicencio (pedro)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. You reported this bug a while ago and there hasn't been any activity in it recently. We were wondering is this still an issue for you? Could you try to reproduce the same with Ubuntu 8.10 or 9.04? Thanks in advance.

[Pedro Villavicencio (pedro)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to New. Thanks again!.