diff --git a/CHANGES b/CHANGES
index c4a232dc7a..1fe885e517 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2958.	[bug]		When canceling validation it was possible to leak
+			memory. [RT #20800]
+
 2957.	[bug]		RTT estimates were not being adjusted on ICMP errors.
 			[RT #20772]
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 41d022d8dd..12f89e68f3 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.418 2010/03/04 06:43:21 marka Exp $ */
+/* $Id: resolver.c,v 1.419 2010/03/04 22:25:31 marka Exp $ */
 
 /*! \file */
 
@@ -484,7 +484,7 @@ valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
 		inc_stats(fctx->res, dns_resstatscounter_val);
 		if ((valoptions & DNS_VALIDATOR_DEFER) == 0) {
 			INSIST(fctx->validator == NULL);
-			fctx->validator  = validator;
+			fctx->validator = validator;
 		}
 		ISC_LIST_APPEND(fctx->validators, validator, link);
 	} else
@@ -3911,14 +3911,6 @@ maybe_destroy(fetchctx_t *fctx) {
 	     validator != NULL; validator = next_validator) {
 		next_validator = ISC_LIST_NEXT(validator, link);
 		dns_validator_cancel(validator);
-		/*
-		 * If this is a active validator wait for the cancel
-		 * to complete before calling dns_validator_destroy().
-		 */
-		if (validator == fctx->validator)
-			continue;
-		ISC_LIST_UNLINK(fctx->validators, validator, link);
-		dns_validator_destroy(&validator);
 	}
 
 	bucketnum = fctx->bucketnum;
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index b693a37d73..86cdd33a7a 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.185 2010/02/25 05:08:01 tbox Exp $ */
+/* $Id: validator.c,v 1.186 2010/03/04 22:25:31 marka Exp $ */
 
 #include <config.h>
 
@@ -3908,19 +3908,19 @@ dns_validator_cancel(dns_validator_t *validator) {
 
 	validator_log(validator, ISC_LOG_DEBUG(3), "dns_validator_cancel");
 
-	if (validator->event != NULL) {
-		if (validator->fetch != NULL)
-			dns_resolver_cancelfetch(validator->fetch);
-
-		if (validator->subvalidator != NULL)
-			dns_validator_cancel(validator->subvalidator);
-		if ((validator->options & DNS_VALIDATOR_DEFER) != 0) {
-			isc_task_t *task = validator->event->ev_sender;
-			validator->options &= ~DNS_VALIDATOR_DEFER;
-			isc_event_free((isc_event_t **)&validator->event);
-			isc_task_detach(&task);
-		}
+	if ((validator->attributes & VALATTR_CANCELED) == 0) {
 		validator->attributes |= VALATTR_CANCELED;
+	     	if (validator->event != NULL) {
+			if (validator->fetch != NULL)
+				dns_resolver_cancelfetch(validator->fetch);
+
+			if (validator->subvalidator != NULL)
+				dns_validator_cancel(validator->subvalidator);
+			if ((validator->options & DNS_VALIDATOR_DEFER) != 0) {
+				validator->options &= ~DNS_VALIDATOR_DEFER;
+				validator_done(validator, ISC_R_CANCELED);
+			}
+		}
 	}
 	UNLOCK(&validator->lock);
 }