fix a logic error on memcached_server_remove which will cause double free problem

diff --git a/libmemcached/memcached_connect.c b/libmemcached/memcached_connect.c
index d58b354f38b21ca9221a78570758bc041535c726..de69e4465ef8c68e34d608f4bace32d4d0cd5042 100644 (file)
--- a/libmemcached/memcached_connect.c
+++ b/libmemcached/memcached_connect.c
@@ -34,7 +34,10 @@ static memcached_return set_hostinfo(memcached_server_st *server)
   }
 
   if (server->address_info)
+  {
     freeaddrinfo(server->address_info);
+    server->address_info= NULL;
+  }
   server->address_info= ai;
 
   return MEMCACHED_SUCCESS;
@@ -177,6 +180,7 @@ static memcached_return network_connect(memcached_server_st *ptr)
       if (ptr->server_failure_counter >= ptr->root->server_failure_limit) 
       {
           memcached_server_remove(ptr);
+          return MEMCACHED_FAILURE;
       }
     }
     /* Old connection junk still is in the structure */

diff --git a/libmemcached/memcached_hosts.c b/libmemcached/memcached_hosts.c
index dd137dda0f088e08b192ad6b2d993ae271c187af..34b93c6f4d3b703569d06d2f0a6d59e31a84718b 100644 (file)
--- a/libmemcached/memcached_hosts.c
+++ b/libmemcached/memcached_hosts.c
@@ -295,15 +295,14 @@ memcached_return memcached_server_remove(memcached_server_st *st_ptr)
       memcpy(list+index, list+x, sizeof(memcached_server_st));
       index++;
     } 
-    else 
-    {
-      ptr->number_of_hosts--;
-    }
   }
-
+  ptr->number_of_hosts= index;
 
   if (st_ptr->address_info) 
+  {
     freeaddrinfo(st_ptr->address_info);
+    st_ptr->address_info= NULL;
+  }
   run_distribution(ptr);
 
   return MEMCACHED_SUCCESS;