Description:
------------

steps to reproduce:
1) make your memcached server unavailable
2) run the included code

I've been trying to track the bug down. It segfaults right in the fourth iteration of:
while ((request = mmc_queue_pop(&(pool->free_requests))) != NULL) {
    pool->protocol->free_request(request);
}
in mmc_pool_free()

just prior to the segmentation fault, the mmc_request_t *request contains this:
(gdb) print *request
$6 = {io = 0x5a5a5a5a5a5a5a5a, sendbuf = {value = {c = 0x5a5a5a5a5a5a5a5a <Address 0x5a5a5a5a5a5a5a5a out of bounds>, len = 6510615555426900570, a = 6510615555426900570}, idx = 1515870810}, readbuf = {value = {
      c = 0x5a5a5a5a5a5a5a5a <Address 0x5a5a5a5a5a5a5a5a out of bounds>, len = 6510615555426900570, a = 6510615555426900570}, idx = 1515870810}, key = 'Z' <repeats 251 times>, key_len = 1515870810, protocol = 1515870810,
  failed_servers = {items = 0x5a5a5a5a5a5a5a5a, alloc = 1515870810, head = 1515870810, tail = 1515870810, len = 1515870810}, failed_index = 1515870810, read = 0x5a5a5a5a5a5a5a5a, parse = 0x5a5a5a5a5a5a5a5a,
  value_handler = 0x5a5a5a5a5a5a5a5a, value_handler_param = 0x5a5a5a5a5a5a5a5a, response_handler = 0x5a5a5a5a5a5a5a5a, response_handler_param = 0x5a5a5a5a5a5a5a5a, failover_handler = 0x5a5a5a5a5a5a5a5a,
  failover_handler_param = 0x5a5a5a5a5a5a5a5a, udp = {reqid = 23130, seqid = 23130, total = 23130}}


At this point an assistance is needed.

Thank you

Reproduce code:
---------------
<?php
session_start()
?>

Expected result:
----------------
the script should end normally returning non-zero value

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f3289da7710 (LWP 6607)]
0x00000000009567a8 in zend_mm_check_ptr (heap=Cannot access memory at address 0x8000cec0d818
) at /usr/src/php5.3/source/php5-5.3.3/Zend/zend_alloc_canary.c:1433
1433            if (p->info._size != ZEND_MM_NEXT_BLOCK(p)->info._prev) {
(gdb) bt
#0  0x00000000009567a8 in zend_mm_check_ptr (heap=Cannot access memory at address 0x8000cec0d818
) at /usr/src/php5.3/source/php5-5.3.3/Zend/zend_alloc_canary.c:1433
#1  0x00000000009585df in _zend_mm_free_canary_int (heap=Cannot access memory at address 0x8000cec0d8b8
) at /usr/src/php5.3/source/php5-5.3.3/Zend/zend_alloc_canary.c:2079
#2  0x000000000090284c in _efree (ptr=Cannot access memory at address 0x8000cec0d938
) at /usr/src/php5.3/source/php5-5.3.3/Zend/zend_alloc.c:2616
#3  0x00007f3284c5e666 in mmc_buffer_free (buffer=0x2b9f140) at /root/php-session/php-memcache-3.0.5/build-tree/memcache-3.0.5/memcache_pool.c:56
#4  0x00007f3284c5ea96 in mmc_request_free (request=0x2b9f138) at /root/php-session/php-memcache-3.0.5/build-tree/memcache-3.0.5/memcache_pool.c:181
#5  0x00007f3284c61319 in mmc_pool_free (pool=0x2b9d120) at /root/php-session/php-memcache-3.0.5/build-tree/memcache-3.0.5/memcache_pool.c:945
#6  0x00007f3284c6c276 in ps_close_memcache (mod_data=0x1194220) at /root/php-session/php-memcache-3.0.5/build-tree/memcache-3.0.5/memcache_session.c:195
#7  0x00000000006f2906 in php_session_save_current_state () at /usr/src/php5.3/source/php5-5.3.3/ext/session/session.c:625
#8  0x00000000006f69b1 in php_session_flush () at /usr/src/php5.3/source/php5-5.3.3/ext/session/session.c:1517
#9  0x00000000006f87c1 in zm_deactivate_session (type=Cannot access memory at address 0x8000cec0db4c
) at /usr/src/php5.3/source/php5-5.3.3/ext/session/session.c:2171
#10 0x000000000093413d in module_registry_cleanup (module=Cannot access memory at address 0x8000cec0db78
) at /usr/src/php5.3/source/php5-5.3.3/Zend/zend_API.c:2150
#11 0x000000000093c412 in zend_hash_reverse_apply (ht=Cannot access memory at address 0x8000cec0db98
) at /usr/src/php5.3/source/php5-5.3.3/Zend/zend_hash.c:957
#12 0x0000000000929dbe in zend_deactivate_modules () at /usr/src/php5.3/source/php5-5.3.3/Zend/zend.c:938
#13 0x00000000008aa337 in php_request_shutdown (dummy=Cannot access memory at address 0x8000cec0dcb8
) at /usr/src/php5.3/source/php5-5.3.3/main/main.c:1610
#14 0x0000000000a23c3a in main (argc=Cannot access memory at address 0x8000cec0de9c
) at /usr/src/php5.3/source/php5-5.3.3/sapi/cli/php_cli.c:1377