access of freed memory (ITS#700)

[jschimmel@mirapoint.com]

Full_Name: John E. Schimmel
Version: 2.X-devel
OS: FreeBSD
URL: 
Submission from: (NULL) (208.48.74.2)



If ldbm_back_add is unable to insert an entry into a database then the
entry gets freed by do_add while there is still a pointer to it in
the cache.  Later searches of the cache core dump.  It looks like
cache_return_entry_w should remove the item from the avl_tree even if
the state is CACHE_ENTRY_CREATING, or entry_free should call the backend,
but I don't understand this code.

Later,
John