Comment # 13 on bug 1107197 from Adam Mizerski

Invalid write of size 8
   at 0x52267BE: curl_multi_remove_handle (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283072: cb_data_free (nm-connectivity.c:208)
   by 0x2832EA: _con_curl_check_connectivity (nm-connectivity.c:270)
   by 0x28339C: _con_curl_socketevent_cb (nm-connectivity.c:359)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)
 Address 0x8d10420 is 0 bytes inside a block of size 21,336 free'd
   at 0x40319AB: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210900: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521ECAC: curl_easy_cleanup (in /usr/lib64/libcurl.so.4.5.0)
   by 0x28307B: cb_data_free (nm-connectivity.c:209)
   by 0x283C71: nm_connectivity_check_cancel (nm-connectivity.c:574)
   by 0x214AE8: concheck_handle_complete (nm-device.c:2601)
   by 0x222157: concheck_cb (nm-device.c:2725)
   by 0x28361F: easy_header_cb (nm-connectivity.c:424)
   by 0x520A1BB: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x520864F: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521CB87: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x5226D7A: ??? (in /usr/lib64/libcurl.so.4.5.0)
 Block was alloc'd at
   at 0x40327A5: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210C49: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521E9D3: curl_easy_init (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283A74: nm_connectivity_check_start (nm-connectivity.c:528)
   by 0x2190EC: concheck_start (nm-device.c:2772)
   by 0x219222: concheck_periodic_schedule_set (nm-device.c:2439)
   by 0x21937D: concheck_periodic_timeout_cb (nm-device.c:2265)
   by 0x4C73932: g_timeout_dispatch (gmain.c:4649)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)

Invalid read of size 4
   at 0x5228471: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x52287C4: curl_multi_socket_action (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283110: _con_curl_check_connectivity (nm-connectivity.c:249)
   by 0x28339C: _con_curl_socketevent_cb (nm-connectivity.c:359)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)
 Address 0x937f610 is 21,328 bytes inside a block of size 21,336 free'd
   at 0x40319AB: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210900: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521ECAC: curl_easy_cleanup (in /usr/lib64/libcurl.so.4.5.0)
   by 0x28307B: cb_data_free (nm-connectivity.c:209)
   by 0x283C71: nm_connectivity_check_cancel (nm-connectivity.c:574)
   by 0x214AE8: concheck_handle_complete (nm-device.c:2601)
   by 0x222157: concheck_cb (nm-device.c:2725)
   by 0x28361F: easy_header_cb (nm-connectivity.c:424)
   by 0x520A1BB: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x520864F: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521CB87: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x5226D7A: ??? (in /usr/lib64/libcurl.so.4.5.0)
 Block was alloc'd at
   at 0x40327A5: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210C49: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521E9D3: curl_easy_init (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283A74: nm_connectivity_check_start (nm-connectivity.c:528)
   by 0x2190EC: concheck_start (nm-device.c:2772)
   by 0x219222: concheck_periodic_schedule_set (nm-device.c:2439)
   by 0x21937D: concheck_periodic_timeout_cb (nm-device.c:2265)
   by 0x4C73932: g_timeout_dispatch (gmain.c:4649)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)

Invalid write of size 8
   at 0x5225E76: curl_multi_add_handle (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283B4A: nm_connectivity_check_start (nm-connectivity.c:541)
   by 0x2190EC: concheck_start (nm-device.c:2772)
   by 0x219222: concheck_periodic_schedule_set (nm-device.c:2439)
   by 0x21937D: concheck_periodic_timeout_cb (nm-device.c:2265)
   by 0x4C73932: g_timeout_dispatch (gmain.c:4649)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)
 Address 0x8d10420 is 0 bytes inside a block of size 21,336 free'd
   at 0x40319AB: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210900: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521ECAC: curl_easy_cleanup (in /usr/lib64/libcurl.so.4.5.0)
   by 0x28307B: cb_data_free (nm-connectivity.c:209)
   by 0x283C71: nm_connectivity_check_cancel (nm-connectivity.c:574)
   by 0x214AE8: concheck_handle_complete (nm-device.c:2601)
   by 0x222157: concheck_cb (nm-device.c:2725)
   by 0x28361F: easy_header_cb (nm-connectivity.c:424)
   by 0x520A1BB: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x520864F: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521CB87: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x5226D7A: ??? (in /usr/lib64/libcurl.so.4.5.0)
 Block was alloc'd at
   at 0x40327A5: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210C49: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521E9D3: curl_easy_init (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283A74: nm_connectivity_check_start (nm-connectivity.c:528)
   by 0x2190EC: concheck_start (nm-device.c:2772)
   by 0x219222: concheck_periodic_schedule_set (nm-device.c:2439)
   by 0x21937D: concheck_periodic_timeout_cb (nm-device.c:2265)
   by 0x4C73932: g_timeout_dispatch (gmain.c:4649)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)

Invalid write of size 8
   at 0x52267BE: curl_multi_remove_handle (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283072: cb_data_free (nm-connectivity.c:208)
   by 0x2835C6: _timeout_cb (nm-connectivity.c:473)
   by 0x4C73932: g_timeout_dispatch (gmain.c:4649)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)
 Address 0x8d10420 is 0 bytes inside a block of size 21,336 free'd
   at 0x40319AB: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210900: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521ECAC: curl_easy_cleanup (in /usr/lib64/libcurl.so.4.5.0)
   by 0x28307B: cb_data_free (nm-connectivity.c:209)
   by 0x283C71: nm_connectivity_check_cancel (nm-connectivity.c:574)
   by 0x214AE8: concheck_handle_complete (nm-device.c:2601)
   by 0x222157: concheck_cb (nm-device.c:2725)
   by 0x28361F: easy_header_cb (nm-connectivity.c:424)
   by 0x520A1BB: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x520864F: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521CB87: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x5226D7A: ??? (in /usr/lib64/libcurl.so.4.5.0)
 Block was alloc'd at
   at 0x40327A5: calloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x5210C49: ??? (in /usr/lib64/libcurl.so.4.5.0)
   by 0x521E9D3: curl_easy_init (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283A74: nm_connectivity_check_start (nm-connectivity.c:528)
   by 0x2190EC: concheck_start (nm-device.c:2772)
   by 0x219222: concheck_periodic_schedule_set (nm-device.c:2439)
   by 0x21937D: concheck_periodic_timeout_cb (nm-device.c:2265)
   by 0x4C73932: g_timeout_dispatch (gmain.c:4649)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)

Invalid write of size 8
   at 0x52267BE: curl_multi_remove_handle (in /usr/lib64/libcurl.so.4.5.0)
   by 0x283072: cb_data_free (nm-connectivity.c:208)
   by 0x283284: _con_curl_check_connectivity (nm-connectivity.c:275)
   by 0x28339C: _con_curl_socketevent_cb (nm-connectivity.c:359)
   by 0x4C72EA7: g_main_dispatch (gmain.c:3176)
   by 0x4C72EA7: g_main_context_dispatch (gmain.c:3829)
   by 0x4C73297: g_main_context_iterate.isra.26 (gmain.c:3902)
   by 0x4C73591: g_main_loop_run (gmain.c:4098)
   by 0x136071: main (main.c:438)
 Address 0xd1ab620 is 21,600 bytes inside a block of size 32,768 free'd
   at 0x40319AB: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x18A932: _nm_auto_free_impl (nm-macros-internal.h:76)
   by 0x18A932: event_handler_recvmsgs (nm-linux-platform.c:6579)
   by 0x18E07C: event_handler_read_netlink (nm-linux-platform.c:6790)
   by 0x18F09C: delayed_action_handle_WAIT_FOR_NL_RESPONSE
(nm-linux-platform.c:3594)
   by 0x18F09C: delayed_action_handle_one (nm-linux-platform.c:3669)
   by 0x18F09C: delayed_action_handle_all (nm-linux-platform.c:3687)
   by 0x191D78: do_add_addrroute (nm-linux-platform.c:4577)
   by 0x192169: ip6_address_add (nm-linux-platform.c:6273)
   by 0x1A5097: nm_platform_ip6_address_add (nm-platform.c:3181)
   by 0x1A91D1: nm_platform_ip6_address_sync (nm-platform.c:3798)
   by 0x18183B: nm_ip6_config_commit (nm-ip6-config.c:549)
   by 0x21FC77: nm_device_set_ip_config (nm-device.c:11397)
   by 0x221318: ip_config_merge_and_apply (nm-device.c:6785)
   by 0x2345D4: activate_stage5_ip6_config_commit (nm-device.c:9964)
 Block was alloc'd at
   at 0x403077F: malloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0x4C788D0: g_malloc (gmem.c:99)
   by 0x198012: nl_recv (nm-netlink.c:1403)
   by 0x18A632: event_handler_recvmsgs (nm-linux-platform.c:6584)
   by 0x18E07C: event_handler_read_netlink (nm-linux-platform.c:6790)
   by 0x18F09C: delayed_action_handle_WAIT_FOR_NL_RESPONSE
(nm-linux-platform.c:3594)
   by 0x18F09C: delayed_action_handle_one (nm-linux-platform.c:3669)
   by 0x18F09C: delayed_action_handle_all (nm-linux-platform.c:3687)
   by 0x191D78: do_add_addrroute (nm-linux-platform.c:4577)
   by 0x192169: ip6_address_add (nm-linux-platform.c:6273)
   by 0x1A5097: nm_platform_ip6_address_add (nm-platform.c:3181)
   by 0x1A91D1: nm_platform_ip6_address_sync (nm-platform.c:3798)
   by 0x18183B: nm_ip6_config_commit (nm-ip6-config.c:549)
   by 0x21FC77: nm_device_set_ip_config (nm-device.c:11397)