This was originally discovered and fixed by Milan Crha; I'm just forward-porting his fix to the master branch. self->clients takes ownership of this source but we don't currently have ownership here, leading to a double free vulnerability. Fixes #435