(ITS#8760) LMDB: seg fault on opening a new database

[github@nicwatson.org]

Full_Name: Nic Watson
Version: LMDB 0.9.21
OS: Ubuntu 16.04.3 LTS
URL: https://gist.github.com/jnwatson/86b43b0515fe552a087d741d4ab43922
Submission from: (NULL) (108.56.136.246)


See the URL for the minimal C program to reproduce the crash and the gdb
backtrace.

LMDB will seg fault in mdb_dbi_open when creating a new database if the
environment was opened read-only.

This was found trying to update py-lmdb from 0.9.19 to 0.9.21.  Two unit tests
crashed that didn't crash before, both on the same line in mdb.c.  The program
in the URL is derived from one of the tests.

The change was introduced in commit e8e82933.  In mdb.c, line 9772
(https://github.com/LMDB/lmdb/blob/LMDB_0.9.21/libraries/liblmdb/mdb.c#L9772)
the mdb_cursor_put was wrapped in the macro WITH_CURSOR_TRACKING.  In that
macro, the variable tp is assigned the address of an entry of the passed-in
cursor's transaction's mt_cursors array.  However, mt_cursors isn't initialized
in this case.