the backtrace is a bit confusing, the error displayed is "screenshot not valid" which would hit the warning on l424 because base_uri is null, unsure how it can go to line 440 in this case...

I'm also confused about that; does valgrind spot anything at runtim?

Nothing from valgrind, but I added print-type debugging in the code, it's the l424 call which gives the warning

"	/* download file */
	g_debug ("downloading %s to %s", url, ssimg->filename);
	base_uri = soup_uri_new (url);
	if (base_uri == NULL || !SOUP_URI_VALID_FOR_HTTP (base_uri)) {
		/* TRANSLATORS: this is when we try to download a screenshot
		 * that was not a valid URL */
		gs_screenshot_image_set_error (ssimg, _("Screenshot not valid"));
		soup_uri_free (base_uri);
		return;
	}"

the url is invalid (due to https://github.com/hughsie/appstream-glib/issues/70) so base_uri is null, the code should probably be changed to 

if(base_uri)
    soup_uri_free (base_uri);

(I'm going to attach a patch with the suggested change after testing it)

Created attachment 322454 [details] [review]
that fixes the warning

commit 10e988f848441fdf55362a15bf10fcd6b047eeb8
Author: Richard Hughes <richard@hughsie.com>
Date:   Mon Aug 15 09:34:17 2016 +0100

    trivial: Use g_autoptr() for the SoupURI
    
    The soup_uri_free() function is not NULL safe.
    
    Resolves: https://bugzilla.gnome.org/show_bug.cgi?id=762689