diff --git a/0001-password-Clean-up-signal-handler-in-dispose.patch b/0001-password-Clean-up-signal-handler-in-dispose.patch
new file mode 100644
index 0000000..9150c3a
--- /dev/null
+++ b/0001-password-Clean-up-signal-handler-in-dispose.patch
@@ -0,0 +1,49 @@
+From 03c1e4338e7bb58c57370c0e32c937207494fa8d Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Thu, 24 Jul 2014 17:17:40 -0400
+Subject: [PATCH] password: Clean up signal handler in dispose
+
+This is the only place where we connect to a driver signal,
+and we never clean up the handler, so it is left dangling
+when the pages get reconstructed (since the driver object
+survives that). This might explain the mysterious memory
+corruption crashes that various people have been seeing,
+which usually involved this signal handler.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=733555
+https://bugzilla.gnome.org/show_bug.cgi?id=732525
+---
+ gnome-initial-setup/pages/password/gis-password-page.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/gnome-initial-setup/pages/password/gis-password-page.c b/gnome-initial-setup/pages/password/gis-password-page.c
+index 20144fd..7ab9662 100644
+--- a/gnome-initial-setup/pages/password/gis-password-page.c
++++ b/gnome-initial-setup/pages/password/gis-password-page.c
+@@ -238,6 +238,15 @@ gis_password_page_constructed (GObject *object)
+ }
+ 
+ static void
++gis_password_page_dispose (GObject *object)
++{
++  g_signal_handlers_disconnect_by_func (GIS_PAGE (object)->driver,
++                                        username_changed, object);
++
++  G_OBJECT_CLASS (gis_password_page_parent_class)->dispose (object);
++}
++
++static void
+ gis_password_page_locale_changed (GisPage *page)
+ {
+   gis_page_set_title (GIS_PAGE (page), _("Password"));
+@@ -261,6 +270,7 @@ gis_password_page_class_init (GisPasswordPageClass *klass)
+   page_class->locale_changed = gis_password_page_locale_changed;
+   page_class->save_data = gis_password_page_save_data;
+   object_class->constructed = gis_password_page_constructed;
++  object_class->dispose = gis_password_page_dispose;
+ }
+ 
+ static void
+-- 
+2.0.1
+
diff --git a/gnome-initial-setup.spec b/gnome-initial-setup.spec
index e0a49d6..101fa15 100644
--- a/gnome-initial-setup.spec
+++ b/gnome-initial-setup.spec
@@ -1,6 +1,6 @@
 Name:           gnome-initial-setup
 Version:        3.12.1
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Bootstrapping your OS
 
 License:        GPLv2+
@@ -11,6 +11,9 @@ Source0:        http://download.gnome.org/sources/%{name}/3.12/%{name}-%{version
 # https://bugzilla.gnome.org/show_bug.cgi?id=687957
 Patch0: yelp-fixes.patch
 
+# fix a memory corruption crash
+Patch1: 0001-password-Clean-up-signal-handler-in-dispose.patch
+
 %global nm_version 0.9.6.4
 %global glib_required_version 2.36.0
 %global gtk_required_version 3.7.11
@@ -66,6 +69,7 @@ you through configuring it. It is integrated with gdm.
 %prep
 %setup -q
 %patch0 -p1 -b .yelp-fixes
+%patch1 -p1 
 
 %build
 %configure
@@ -104,6 +108,9 @@ useradd -rM -d /run/gnome-initial-setup/ -s /sbin/nologin %{name} &>/dev/null ||
 %{_datadir}/polkit-1/rules.d/20-gnome-initial-setup.rules
 
 %changelog
+* Thu Jul 24 2014 Matthias Clasen <mclasen@redhat.com> - 3.12.1-3
+- Fix a memory corruption crash (#1116478)
+
 * Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.12.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild