url.c and transfer.c: nullify connection pointer when free()'ed

2 files changed, 10 insertions, 3 deletions

diff --git a/lib/transfer.c b/lib/transfer.c
index 413a28082..e56fffd7b 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -1991,12 +1991,17 @@ connect_host(struct SessionHandle *data,
     /* Now, if async is TRUE here, we need to wait for the name
        to resolve */
     res = Curl_resolver_wait_resolv(*conn, NULL);
-    if(CURLE_OK == res)
+    if(CURLE_OK == res) {
       /* Resolved, continue with the connection */
       res = Curl_async_resolved(*conn, &protocol_done);
-    else
+      if(res)
+        *conn = NULL;
+    }
+    else {
       /* if we can't resolve, we kill this "connection" now */
       (void)Curl_disconnect(*conn, /* dead_connection */ FALSE);
+      *conn = NULL;
+    }
   }
 
   return res;
diff --git a/lib/url.c b/lib/url.c
index 40dcd1568..8118fe5c5 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -593,8 +593,10 @@ CURLcode Curl_ch_connc(struct SessionHandle *data,
        NOTE: for conncache_multi cases we must make sure that we only
        close handles not in use.
     */
-    for(i=newamount; i< c->num; i++)
+    for(i=newamount; i< c->num; i++) {
       Curl_disconnect(c->connects[i], /* dead_connection */ FALSE);
+      c->connects[i] = NULL;
+    }
 
     /* If the most recent connection is no longer valid, mark it
        invalid. */