SIGABRT with "free(): invalid next size (normal)" in HPCupsFilter::cleanup

I have been seeing a crash when printing for some time. I have attached an example of a file which causes the crash.

dagon:/tmp# /usr/lib/cups/filter/pdftopdf 1 debian '' 1 '' </tmp/1605427739.pdf >print_step_1.pdf
<...see transcript.txt...>
dagon:/tmp# /usr/lib/cups/filter/gstoraster 1 debian '' 1 '' <print_step_1.pdf >print_step_2.raster
<...see transcript.txt...>
dagon:/tmp# /usr/lib/cups/filter/hpcups 1 debian '' 1 '' <print_step_2.raster >print_step_3.hpcups
STATE: -marker-supply-low-warning
PAGE: 1 1
PAGE: 2 1
free(): invalid next size (normal)
Aborted (core dumped)

dagon:/tmp# gdb /usr/lib/cups/filter/hpcups core
...
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007f5af802c537 in __GI_abort () at abort.c:79
#2 0x00007f5af80856c8 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f5af8193e31 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3 0x00007f5af808c9ba in malloc_printerr (str=str@entry=0x7f5af8196238 "free(): invalid next size (normal)") at malloc.c:5347
#4 0x00007f5af808de8c in _int_free (av=0x7f5af81c5b80 <main_arena>, p=0x561e3ecd1fc0, have_lock=<optimized out>) at malloc.c:4322
#5 0x0000561e3d1255c6 in HPCupsFilter::cleanup (this=0x561e3d1881c0 <filter>) at prnt/hpcups/HPCupsFilter.cpp:227
#6 0x0000561e3d127df1 in HPCupsFilter::closeFilter (this=0x561e3d1881c0 <filter>) at prnt/hpcups/HPCupsFilter.cpp:221
#7 HPCupsFilter::StartPrintJob (this=0x561e3d1881c0 <filter>, argc=<optimized out>, argv=0x7fffb82c6f18) at prnt/hpcups/HPCupsFilter.cpp:604
#8 0x00007f5af802dcca in __libc_start_main (main=0x561e3d124e10 <main(int, char**)>, argc=6, argv=0x7fffb82c6f18, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffb82c6f08) at ../csu/libc-start.c:308
#9 0x0000561e3d124efa in _start () at prnt/hpcups/HPCupsFilter.cpp:919

The tail of an strace (from a different run to the above gdb session) is:

...
unlink("/root/hp_debian_cups_SwapedPagesXXXXXX") = -1 ENOENT (No such file or directory)
write(1, "\33E", 2) = 2
write(1, "\33%-12345X", 9) = 9
writev(2, [{iov_base="free(): invalid next size (norma"..., iov_len=34}, {iov_base="\n", iov_len=1}], 2) = 35
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9a873ad000
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0
getpid() = 2424977
gettid() = 2424977
tgkill(2424977, 2424977, SIGABRT) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=2424977, si_uid=0} ---
+++ killed by SIGABRT (core dumped) +++

I am running Debian's package version 3.20.9+dfsg0-4