Reproduction steps: When UPnP port mapping is enabled, open settings, and attempt to uncheck UPnP port mapping.

Expected behavior: Checkbox unchecks.

Observed behavior: Segfault.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb3c0cb90 (LWP 23682)]
0xb70c67e2 in free () from /lib/i686/cmov/libc.so.6
(gdb) bt
#0  0xb70c67e2 in free () from /lib/i686/cmov/libc.so.6
#1  0x0837b96b in FreeUPNPUrls ()
#2  0x08096a59 in ThreadMapPort2 (parg=0x0) at net.cpp:940
#3  0x08096bff in ThreadMapPort (parg=0x0) at net.cpp:877
#4  0xb71b74c0 in start_thread () from /lib/i686/cmov/libpthread.so.0
#5  0xb71366de in clone () from /lib/i686/cmov/libc.so.6

I'm not sure why there aren't full symbols. I'm using the standard makefile with the -g option.

Note that I've also seen a segfault when originally enabling UPnP port mapping after clicking the checkbox and hitting okay. I can't reproduce it now because I'm unable to disable port mapping due to the segfault above.

System/build information:
git checkout as of b37f09a
Debian 5.0
Linux 2.6.26-1-686 #1 SMP Sat Jan 10 18:29:31 UTC 2009 i686 GNU/Linux
gcc 4.3.2
miniupnpc 1.5