http-push: double free or corruption (!prev): 0x09fedb50

Hi,

I'm trying to push over https and I keep getting a crash. "curl -netrc
https://server/repo/HEAD" seems to work fine.

After that I keep getting this error for a while:
Error: cannot lock existing info/refs
error: failed to push some refs to 'https://server/repo'

I'm attaching the output of valgrind and this is the backtrace (not on
the same run):
#0  0x00fef416 in __kernel_vsyscall ()
#1  0x005d7460 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x005d8e28 in abort () at abort.c:88
#3  0x00614fed in __libc_message (do_abort=2, fmt=0x6efe68 "*** glibc
detected *** %s: %s: 0x%s ***\n") at
../sysdeps/unix/sysv/linux/libc_fatal.c:170
#4  0x0061b3a4 in malloc_printerr (action=2, str=0x6eff60 "double free
or corruption (!prev)", ptr=0x9fedb50) at malloc.c:5994
#5  0x0061d356 in __libc_free (mem=0x9fedb50) at malloc.c:3625
#6  0x064d5b37 in PR_Free (ptr=0x0) at
../../../mozilla/nsprpub/pr/src/malloc/prmem.c:490
#7  0x00df72f8 in nss_ZRealloc (pointer=0x9fedb58, newSize=4096) at arena.c:1076
#8  0x00de579b in pem_CreateObject (fwInstance=0x8109ba0,
fwSession=0x810bac8, mdToken=0x8109cf8, pTemplate=0xbfffd6e4,
ulAttributeCount=4, pError=0xbfffd608) at pobject.c:1080
#9  0x00de73ce in pem_mdSession_CreateObject (mdSession=0x810bb38,
fwSession=0x810bac8, mdToken=0x8109cf8, fwToken=0x810b098,
mdInstance=0xe08180, fwInstance=0x8109ba0,
    arena=0x810aff8, pTemplate=0xbfffd6e4, ulAttributeCount=4,
pError=0xbfffd608) at psession.c:156
#10 0x00deb7f4 in nssCKFWSession_CreateObject (fwSession=0x810bac8,
pTemplate=0xbfffd6e4, ulAttributeCount=4, pError=0xbfffd608) at
session.c:1353
#11 0x00df32c9 in NSSCKFWC_CreateObject (fwInstance=0x8109ba0,
hSession=1, pTemplate=0xbfffd6e4, ulCount=4, phObject=0xbfffd698) at
wrap.c:1991
#12 0x00de24ac in pemC_CreateObject (hSession=1, pTemplate=0xbfffd6e4,
ulCount=4, phObject=0xbfffd698) at
../../../../../dist/public/nss/nssck.api:566
#13 0x0562fece in PK11_CreateNewObject (slot=0x810ad50, session=1,
theTemplate=0xbfffd6e4, count=4, token=0, objectID=0xbfffd698) at
pk11obj.c:412
#14 0x05630150 in PK11_CreateGenericObject (slot=0x810ad50,
pTemplate=0xbfffd6e4, count=4, token=0) at pk11obj.c:1346
#15 0x052ae9a3 in nss_load_cert (filename=0x9899fb8
"/etc/pki/tls/certs/ca-bundle.crt", cacert=1) at nss.c:346
#16 0x052af3b7 in Curl_nss_connect (conn=0x81d28f8, sockindex=0) at nss.c:956
#17 0x052a6fd5 in Curl_ssl_connect_nonblocking (conn=0x81d28f8,
sockindex=0, done=0xbfffebf9) at sslgen.c:249
#18 0x05286e57 in https_connecting (done=0xbfffebf9, conn=0x81d28f8)
at http.c:1751
#19 Curl_http_connect (conn=0x81d28f8, done=0xbfffebf9) at http.c:1713
#20 0x052a0855 in multi_runsingle (multi=0x80be9c0, easy=0x814d238) at
multi.c:1005
#21 0x052a1099 in curl_multi_perform (multi_handle=0x80be9c0,
running_handles=0xbfffec80) at multi.c:1460
#22 0x0804df41 in step_active_slots () at http.c:450
#23 0x0804df9f in run_active_slot (slot=0x80cd780) at http.c:474
#24 0x0804f7b0 in remote_ls (path=<value optimized out>, flags=3,
userFunc=<value optimized out>, userData=0xbfffeefc) at
http-push.c:1496
#25 0x0805110d in get_remote_object_list () at http-push.c:1540
#26 add_send_request (obj=0x83d0420, lock=0x8142050) at http-push.c:870
#27 0x080511ee in get_delta (revs=0xbfffefb4, lock=0x8142050) at
http-push.c:1695
#28 0x08052204 in main (argc=3, argv=0xbffff314) at http-push.c:241

Any ideas?

-- 
Felipe Contreras