> >From reading lib/url.c I am under impression that the 'reuse =
> >ConnectionExists' stanza in url.c:3698 can select already used connection to
> >be used again. Seems like it is done without checking if the pipelining is
> >enabled. Though, I can be wrong.
>
> I don't see how that code allows double use of the same connection without
> pipelining. Perhaps I'm being stupid, but can you point out exactly how it
> would get an already used connection?

I am sorry, being wrong: missed the very first bits from the
ConnectionExists that are checking for the pipelining.

> >>Ouch. That seems to imply that the multi->connc->connects[] array has been
> >>freed? That is done by lib/url.c:Curl_rm_connc() and should only by done on
> >>curl_multi_cleanup() when the multi interface is used...
> >
> >No, that implies that the particular member of that array (in my case it is
> >multi->connc->connects[2]) was already freed or initialised with the bad
> >memory location.
>
> I don't think so, since the code first checks that multi->connc->connects[i] is
> non-NULL and we do clear that pointer when we free the area it points to (at
> least I haven't yet found a case where we don't). Thus my suspicion that the
> whole multi->connc->connects[] array is freed.

No, checked this at the first place: the entries with the indices 0 and 1
are perfectly accessible to the gdb, but it says that the array
member with the index 2 is inaccessible. And core dumps precisely at
the point where the index 2 gets dereferenced.

-- 
Eygene