The shared pointer is passed by reference to LLVivoxVoiceClient::deleteSession() where
mSessionsByHandle.erase(iter) removes the last reference causing it to destruct while still
being accessed later on in the function.
(from Kitty Barnett)

The trouble lines are:
			U8 * buffer = (U8 *) ALLOCATE_MEM(LLImageBase::getPrivatePool(), total_size);
			if (cur_size > 0)
			{
				memcpy(buffer, mFormattedImage->getData(), cur_size);
			}

If 'cur_size > mHttpReplyOffset + append_size' then 'total_size -= src_offset' will cause
total_size to be smaller than cur_size causing a write access violation on the memcpy.

Since the response is invalid it seemed best to make it follow the other failed partial condition.
(transplanted from 737e28ec6b4d74f3ff915a4effc13d7b615a6a9b)