[Date Prev][Date Next] [Chronological] [Thread] [Top]

(ITS#8200) Potential use of freed data after mdb_midl_shrink()

Full_Name: Hallvard B Furuseth
Version: LMDB_0.9.15
Submission from: (NULL) (
Submitted by: hallvard

This code is wrong if the realloc in mdb_midl_shrink fails:

	if (mdb_midl_shrink(&txn->mt_free_pgs))
		env->me_free_pgs = txn->mt_free_pgs;

env->me_free_pgs is left pointing as an old, freed IDL.
(Freed when mt_free_pgs was originally grown.)
It should be:

	env->me_free_pgs = txn->mt_free_pgs;

So mdb_midl_shrink() can return void.