Jeff Pohlmeyer did some marvelous debugging to track this one down. We MUST

NOT free the existing hash entry when we try to add a new one that matches
an existing entry. We now instead free the new one, and make the parent
function use the old entry's struct instead.

1 files changed, 14 insertions, 7 deletions

diff --git a/lib/hostip.c b/lib/hostip.c
index c397a3c75..3f465a0d0 100644
--- a/lib/hostip.c
+++ b/lib/hostip.c
@@ -231,15 +231,22 @@ cache_resolv_response(struct SessionHandle *data,
     return NULL;
   }
 
-  dns->inuse = 0;
-  dns->addr = addr;
-
-  /* Store it in our dns cache */
-  Curl_hash_add(data->hostcache, entry_id, entry_len+1,
-                (const void *) dns);
+  dns->inuse = 0;   /* init to not used */
+  dns->addr = addr; /* this is the address(es) */
+
+  /* Store the resolved data in our DNS cache. This function may return a
+     pointer to an existing struct already present in the hash, and it may
+     return the same argument we pass in. Make no assumptions. */
+  dns = Curl_hash_add(data->hostcache, entry_id, entry_len+1, (void *) dns);
+  if(!dns) {
+    /* major badness, run away! */
+    Curl_freeaddrinfo(addr);
+    free(entry_id);
+    return NULL;
+  }
   time(&now);
 
-  dns->timestamp = now;
+  dns->timestamp = now; /* used now */
   dns->inuse++;         /* mark entry as in-use */