The following code, at line 521 of mousepad-file.c:

mapped_file = g_mapped_file_new (filename, FALSE, error);
contents = g_mapped_file_get_contents (mapped_file);

Eventually leads up to this at line 542:

         if (G_LIKELY (file->encoding == MOUSEPAD_ENCODING_UTF_8))
            {
              validate:

              /* glib uses a faster validator when the string is nul-terminated */
              if (G_LIKELY (length > 0 && contents[length] == '\0'))
                length = -1;

This code assumes that g_mapped_file_get_contents will always return NULL terminated. This may be the case when the contents are not exactly a multiple of pages in size and the last page has been wiped to zero before the file has been mapped into it. This is not the case when the file exactly meets a page boundary, in which case contents[length] is out of bounds and causes a crash.

This may be reproduced by creating a UTF-8 encoded text file which is exactly 4096 bytes in length, or 8192 bytes on a SPARC system, then attempting to open it.