Stack corruption error when hosting game on Windows debug build

[historic_bruno]

The error is reported when CNetServerWorker::SetupUPnP completes:

Run-Time Check Failure #2 - Stack around the variable 'urls' was corrupted.

At first, I thought it might be related to #2338, but removing the free calls doesn't fix it, and I haven't found anything obviously wrong in our code.

[Josh]

This doesn't look to be directly related, but I ran 0 A.D. through valgrind while hosting a game and it gave two miniupnpc-related warnings.

==3091== Thread 11:
==3091== Conditional jump or move depends on uninitialised value(s)
==3091==    at 0x6C29156: receivedata (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C23A1A: getHTTPResponse (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C23CD0: miniwget3 (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C24184: miniwget_getaddr (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C26565: UPNP_GetIGDFromUrl (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x4E9707: CNetServerWorker::SetupUPnP(void*) (NetServer.cpp:232)
==3091==    by 0x85E9F6D: start_thread (pthread_create.c:311)
==3091==    by 0x88F99CC: clone (clone.S:113)
==3091== 
==3091== Conditional jump or move depends on uninitialised value(s)
==3091==    at 0x6C29156: receivedata (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C23A1A: getHTTPResponse (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C251B3: simpleUPnPcommand2 (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C2521B: simpleUPnPcommand (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x6C27051: UPNP_GetExternalIPAddress (in /home/joshua/0ad/binaries/system/libminiupnpc.so.10)
==3091==    by 0x4E9878: CNetServerWorker::SetupUPnP(void*) (NetServer.cpp:255)
==3091==    by 0x85E9F6D: start_thread (pthread_create.c:311)
==3091==    by 0x88F99CC: clone (clone.S:113)
==3091== 

[Echelon9]

Related ticket #2338 has been updated with my assessment of the cause of memory corruption here.

​http://trac.wildfiregames.com/ticket/2338#comment:24

[leper]

In 15619:

Fix free() of not allocated struct in the UPnP code. Patch by Echelon9. Fixes #2338, #2418.