Issue 8537 - liblmdb errors with data=NULL and non-matching SET_KEY
Summary: liblmdb errors with data=NULL and non-matching SET_KEY
Status: UNCONFIRMED
Alias: None
Product: LMDB
Classification: Unclassified
Component: liblmdb (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-01 17:00 UTC by Hallvard Furuseth
Modified: 2020-03-12 15:56 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description Hallvard Furuseth 2016-12-01 17:00:30 UTC
Full_Name: Hallvard B Furuseth
Version: mdb.master, fa83b25ec536ac2642f8e0d3c6bf587008513ef4
OS: Linux x86_64
URL: ftp://ftp.openldap.org/incoming/Hallvard-Furuseth-161201.c
Submission from: (NULL) (129.240.203.186)
Submitted by: hallvard


liblmdb can crash or give an EINVAL in some cases after it
forgets to initialize an xcursor on a sub-page:

To fail the init, use next/prev with data=NULL, or SET_KEY
to a non-existe k key (so it gets positioned on next key).
Then try to use the cursor in another operation.

Test program enclosed.
Comment 1 Hallvard Furuseth 2016-12-01 17:21:19 UTC
Related issue:

mdb_cursor_prev/mdb_cursor_last() with data==NULL position the
xcursor at 1st data item, while data!=NULL puts it at last item.

That's unintuitive and should either be documented or normalized -
but changing it can break existing programs.  In the cases when
it didn't just fail earlier, anyway: mdb_cursor_prev(), and maybe
mdb_cursor_last() on a sub-DB.  Haven't tested the latter.

Whatever mdb_cursor_last() ends up doing, I think mdb_cursor_prev()
should do the same.

There is positioning code inside if(data) elsewhere too, but
defaults to doing cursor_first() or something similar.  Don't know
if that can have any visible effect on the next operation.

-- 
Hallvard

Comment 2 Quanah Gibson-Mount 2017-03-20 23:33:36 UTC
moved from Incoming to Software Bugs