In fringe.c:1606 you have:

  xfb = xmalloc (sizeof fb + fb.height * BYTES_PER_BITMAP_ROW);
  fb.bits = b = ((unsigned short *)
ptr_bounds_clip (xfb + 1, fb.height * BYTES_PER_BITMAP_ROW));
  xfb = ptr_bounds_clip (xfb, sizeof *xfb);
  memset (b, 0, fb.height);

I might be wrong but it seems to me that the last line should be:

  memset (b, 0, fb.height * BYTES_PER_BITMAP_ROW);

instead.

I've attached a patch that does exactly that.

Best regards
--
Carlos