diff --git a/ChangeLog b/ChangeLog
index 05d5719465430075a50b8fb7ec96aeb6cdbed7df..b84da4ceebb86239dacdd367ba6751b9a12de0a5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -21,6 +21,8 @@ Changes in version 0.2.1.15??? - ????-??-??
     - Stop using malloc_usable_size() to use more area than we had
       actually allocated: it was safe, but made valgrind really
       unhappy.  Bugfix on 0.2.0.x.
+    - Fix use of freed memory when deciding to mark a non-addable
+      descriptor as never-downloadable.  Bugfix on 0.2.1.9-alpha.
 
 
 Changes in version 0.2.1.14-rc - 2009-04-12
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index c6bfca4546a95885a37c35ec79fad07d2d6bc668..de38e354e0d4c52a6edb1c7011cc2a85fe1a0c96 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -3513,6 +3513,7 @@ router_load_routers_from_string(const char *s, const char *eos,
 
   SMARTLIST_FOREACH_BEGIN(routers, routerinfo_t *, ri) {
     was_router_added_t r;
+    char d[DIGEST_LEN];
     if (requested_fingerprints) {
       base16_encode(fp, sizeof(fp), descriptor_digests ?
                       ri->cache_info.signed_descriptor_digest :
@@ -3533,6 +3534,7 @@ router_load_routers_from_string(const char *s, const char *eos,
       }
     }
 
+    memcpy(d, ri->cache_info.signed_descriptor_digest, DIGEST_LEN);
     r = router_add_to_routerlist(ri, &msg, from_cache, !from_cache);
     if (WRA_WAS_ADDED(r)) {
       any_changed++;
@@ -3541,11 +3543,10 @@ router_load_routers_from_string(const char *s, const char *eos,
       smartlist_clear(changed);
     } else if (WRA_WAS_REJECTED(r)) {
       download_status_t *dl_status;
-      dl_status = router_get_dl_status_by_descriptor_digest(
-          ri->cache_info.signed_descriptor_digest);
+      dl_status = router_get_dl_status_by_descriptor_digest(d);
       if (dl_status) {
         log_info(LD_GENERAL, "Marking router %s as never downloadable",
-                 hex_str(ri->cache_info.signed_descriptor_digest, DIGEST_LEN));
+                 hex_str(d, DIGEST_LEN));
         download_status_mark_impossible(dl_status);
       }
     }