zmq set_metadata memory corruption

gistfile1.txt

==24817== Invalid read of size 4
==24817==    at 0x1003769: zmq::metadata_t::add_ref()
==24817==    by 0x10041AF: zmq::msg_t::set_metadata(zmq::metadata_t*)
==24817==    by 0x102A25A: zmq::xpub_t::xrecv(zmq::msg_t*)
==24817==    by 0x100FCBB: zmq::socket_base_t::recv(zmq::msg_t*, int)
==24817==    by 0xFF3EE5: zmq_msg_recv 
==24817==  Address 0x636beb0 is 0 bytes inside a block of size 56 free'd
==24817==    at 0x4C2E26B: operator delete(void*) 
==24817==    by 0x1004DF6: zmq::msg_t::close() 
==24817==    by 0x102C221: zmq::xpub_t::xread_activated(zmq::pipe_t*) 
==24817==    by 0x1029D4E: zmq::xpub_t::xattach_pipe(zmq::pipe_t*, bool) 
==24817==    by 0x1012FF6: zmq::socket_base_t::process_bind(zmq::pipe_t*) 
==24817==    by 0x1005AD9: zmq::object_t::process_command(zmq::command_t&) 
==24817==    by 0x100DA6B: zmq::socket_base_t::process_commands(int, bool) [clone .constprop.106] 
==24817==    by 0x100ED84: zmq::socket_base_t::getsockopt(int, void*, unsigned long*) 
==24817==  Block was alloc'd at
==24817==    at 0x4C2D43F: operator new(unsigned long, std::nothrow_t const&) 
==24817==    by 0x10478D6: zmq::stream_engine_t::mechanism_ready() 
==24817==    by 0x1047A47: zmq::stream_engine_t::next_handshake_command(zmq::msg_t*) 
==24817==    by 0x1042CEF: zmq::stream_engine_t::out_event() 
==24817==    by 0x1047BA2: zmq::stream_engine_t::process_handshake_command(zmq::msg_t*) 
==24817==    by 0x1044CC2: zmq::stream_engine_t::in_event() 
==24817==    by 0x100201D: zmq::epoll_t::loop() 
==24817==    by 0x101CA17: thread_routine
==24817==    by 0x5AF4709: start_thread (pthread_create.c:333)
==24817==    by 0x5E130AE: clone (clone.S:105)