[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: (ITS#9037) observing crash in mdb_cursor_put()
--_000_MN2PR06MB55017A7261FA27380778753BAFEA0MN2PR06MB5501namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<repost since the previous message came as 64 encoded, apologies>
Hello Howard,
we are not able to reproduce the issue consistently so test code is not ava=
ilable at this time, and I do believe this issue will be present in the lat=
est code as well since Myk also reported the same.. Attaching analysis fro=
m our side, hope it helps.
The call stack what we have seen is,
#0 0x0011b62e in mdb_cursor_put (mc=3D0xffe52d18, key=3D0xffe52e74, dat=
a=3D0xffe52e6c, flags=3D0) at mdb.c:6688
#1 0x0011c8ec in mdb_put (txn=3D0xdc13f008, dbi=3D2, key=3D0xffe52e74, =
data=3D0xffe52e6c, flags=3D0) at mdb.c:8771
#2 0x00b792b8 in LMDB::LMDBContext::createSession (this=3D0x80ca418, si=
d=3D0x8297be4 "sidebf3708f0fd9fcb8e062529da47adf51402dfc4600000000+") at lm=
dbint.cc:460
#3 0x08053564 in updateLMDB (request=3D..., forward=3D@0xffe5315f) at s=
essionserver.cc:1075
#4 processRequestWithoutResponse (request=3D..., forward=3D@0xffe5315f)=
at sessionserver.cc:1160
#5 0x08056a80 in processRequest (this=3D0x80b2ac0, fd=3D33) at sessions=
erver.cc:1189
#6 readFromSock (this=3D0x80b2ac0, fd=3D33) at sessionserver.cc:1342
#7 SockHandler::ioReady (this=3D0x80b2ac0, fd=3D33) at sessionserver.cc=
:1455
#8 0x00ba2592 in runCoreDispatcher (default_t=3D<value optimized out>, =
flags=3D-1) at fds.cc:889
#9 0x00ba2ff7 in DSEvntFds::runDispatcher () at fds.cc:945
#10 0x080559c6 in main () at sessionserver.cc:1739
Here it is helpful to examine frames #0 and #1 in detail in relation to the=
relevant source code /libraries/liblmdb/mdb.c.
Frame #1
#1 0x0011c8ec in mdb_put (txn=3D0xdc13f008, dbi=3D2, key=3D0xffe52e74, dat=
a=3D0xffe52e6c, flags=3D0) at mdb.c:8771
mc =3D {mc_next =3D 0x0, mc_backup =3D 0x0, mc_xcursor =3D 0x0, mc_=
txn =3D 0xdc13f008, mc_dbi =3D 2, mc_db =3D 0xdc13f088, mc_dbx =3D 0xe12150=
38, mc_dbflag =3D 0xdc1cf09a "\033", '\032' <repeats 51 times>, mc_snum =3D=
0, mc_top =3D 0, mc_flags =3D 0, mc_pg =3D {0x0, 0x80b2ac0, 0xffe52d68, 0x=
28afce, 0xdc13f008, 0x80ce9b0, 0xffe52dc8, 0x4c5ff4, 0x2b, 0x80b2ac0, 0xffe=
52d98, 0x49209a, 0x2b, 0x4c5ff4, 0x2121cb, 0x21576c, 0x8297d34, 0x3497af, 0=
x21576c, 0x21316a, 0x8297d34, 0x80ac7b0, 0x1e, 0x46eed6, 0x2b, 0x0, 0x80ce9=
b0, 0x4c5ff4, 0x80ac7b0, 0x8297d34, 0xffe52df8, 0x46fb96}, mc_ki =3D {0, 20=
89, 51120, 2058, 30, 0, 16796, 17, 11760, 65509, 3, 0, 32040, 2089, 30, 0, =
0, 0, 0, 0, 3, 0, 24564, 76, 51120, 2058, 10944, 2059, 11800, 65509, 64758,=
70}} <--------
mx =3D {mx_cursor =3D {mc_next =3D 0x38, mc_backup =3D 0x3, mc_xcur=
sor =3D 0x0, mc_txn =3D 0x0, mc_dbi =3D 0, mc_db =3D 0x28, mc_dbx =3D 0x0, =
mc_dbflag =3D 0x0, mc_snum =3D 3, mc_top =3D 0, mc_flags =3D 17, mc_pg =3D =
{0x3a93d8, 0x10, 0x0, 0x18, 0x3a93a0, 0x0, 0x3a93d0, 0x289abe, 0x3a93a0, 0x=
ffe52d3f, 0xffe52c68, 0x28afce, 0xffe52dbc, 0xffe52db4, 0x3, 0x4c5ff4, 0x11=
, 0x36c99b, 0x6e, 0x77, 0x7c, 0x5b, 0x38, 0x289abe, 0x0, 0x0, 0x0, 0x28, 0x=
0, 0x0, 0x3, 0x10}, mc_ki =3D {37848, 58, 51611, 54, 110, 0, 119, 0, 124, 0=
, 91, 0, 58, 0, 39614, 40, 0, 0, 0, 0, 0, 0, 160, 0, 0, 0, 2, 0, 18, 0, 136=
, 0}}, mx_db =3D {md_pad =3D 3838936, md_flags =3D 51611, md_depth =3D 54, =
md_branch_pages =3D 110, md_leaf_pages =3D 119, md_overflow_pages =3D 124, =
md_entries =3D 91, md_root =3D 56}, mx_dbx =3D {md_name =3D {mv_size =3D 6,=
mv_data =3D 0x0}, md_cmp =3D 0, md_dcmp =3D 0, md_rel =3D 0x40, md_relctx =
=3D 0x0}, mx_dbflag =3D 0 '\000'}
rc =3D 0
And source code for mdb_put() is from mdb.c
int
mdb_put(MDB_txn *txn, MDB_dbi dbi,
MDB_val *key, MDB_val *data, unsigned int flags) {
MDB_cursor mc;
MDB_xcursor mx;
int rc;
if (!key || !data || !TXN_DBI_EXIST(txn, dbi, DB_USRVALID))
return EINVAL;
if (flags & ~(MDB_NOOVERWRITE|MDB_NODUPDATA|MDB_RESERVE|MDB=
_APPEND|MDB_APPENDDUP))
return EINVAL;
if (txn->mt_flags & (MDB_TXN_RDONLY|MDB_TXN_BLOCKED))
return (txn->mt_flags & MDB_TXN_RDONLY) ? E=
ACCES : MDB_BAD_TXN;
mdb_cursor_init(&mc, txn, dbi, &mx); <-------- see source c=
ode below
mc.mc_next =3D txn->mt_cursors[dbi];
txn->mt_cursors[dbi] =3D &mc;
rc =3D mdb_cursor_put(&mc, key, data, flags); <-------- see=
Frame #0
txn->mt_cursors[dbi] =3D mc.mc_next;
return rc;
}
Source Code For mdb_cursor_init() From mdb.c
/** Initialize a cursor for a given transaction and database. */ static voi=
d mdb_cursor_init(MDB_cursor *mc, MDB_txn *txn, MDB_dbi dbi, MDB_xcursor *m=
x) {
mc->mc_next =3D NULL;
mc->mc_backup =3D NULL;
mc->mc_dbi =3D dbi;
mc->mc_txn =3D txn;
mc->mc_db =3D &txn->mt_dbs[dbi];
mc->mc_dbx =3D &txn->mt_dbxs[dbi];
mc->mc_dbflag =3D &txn->mt_dbflags[dbi];
mc->mc_snum =3D 0; <--------
mc->mc_top =3D 0; <--------
mc->mc_pg[0] =3D 0; <--------
mc->mc_ki[0] =3D 0;
mc->mc_flags =3D 0;
if (txn->mt_dbs[dbi].md_flags & MDB_DUPSORT) {
mdb_tassert(txn, mx !=3D NULL);
mc->mc_xcursor =3D mx;
mdb_xcursor_init0(mc);
} else {
mc->mc_xcursor =3D NULL;
}
if (*mc->mc_dbflag & DB_STALE) { <-------- false *mc->mc_db=
flag =3D 27, DB_STALE =3D 0x02 /**< Named-DB record is old=
er than txnID */
mdb_page_search(mc, NULL, MDB_PS_ROOTONLY);
}
}
>From this we know that when mdb_cursor_put() is called, the following value=
s remain assigned:
mc->mc_snum =3D 0; <--------
mc->mc_top =3D 0; <--------
mc->mc_pg[0] =3D 0; <--------
and its noted these two values still have their initial values at the time =
of the segmentation fault.
(gdb) fr 0
#0 0x0011b62e in mdb_cursor_put (mc=3D0xffe52d18, key=3D0xffe52e74, data=3D=
0xffe52e6c, flags=3D0) at mdb.c:6688
6688 in mdb.c
(gdb) p mc->mc_top
$1 =3D 0
(gdb) p mc->mc_pg[mc->mc_top]
$19 =3D (MDB_page *) 0x0
Let us consider how the path taken through mdb_cursor_put() could account f=
or these null variable values which result in a segmentation fault.
Frame #0
#0 0x0011b62e in mdb_cursor_put (mc=3D0xffe52d18, key=3D0xffe52e74, data=
=3D0xffe52e6c, flags=3D0) at mdb.c:6688 <-------- flags =3D 0
env =3D 0x80ce9b0
leaf =3D <value optimized out>
fp =3D <value optimized out>
mp =3D 0x38
sub_root =3D 0x0
fp_flags =3D <value optimized out>
xdata =3D {mv_size =3D 3838880, mv_data =3D 0xdc1cf09a}
rdata =3D 0xffe52e6c
dkey =3D {mv_size =3D 0, mv_data =3D 0x3a93cc}
olddata =3D {mv_size =3D 22, mv_data =3D 0x36c820}
dummy =3D {md_pad =3D 22, md_flags =3D 11128, md_depth =3D 65509, m=
d_branch_pages =3D 16, md_leaf_pages =3D 1507329, md_overflow_pages =3D 0, =
md_entries =3D 3838928, md_root =3D 3833844}
do_sub =3D 0
insert_key =3D -30798 <-------- #define MDB_NOTFOUND (-307=
98)
insert_data =3D -30798 <-------- #define MDB_NOTFOUND (-3079=
8)
mcount =3D 0
dcount =3D 0
nospill =3D 0 <--------
nsize =3D <value optimized out>
rc =3D 0
rc2 =3D <value optimized out>
nflags =3D 0 <--------
__func__ =3D "mdb_cursor_put"
We know that mc->mc_top and mc->mc_pg[0] were initialized to 0 in mdb_curso=
r_init(). As my annotations of the source code below suggest, careful analy=
sis reveals that the paths actually taken through mdb_cursor_put() do not m=
odify these assignments.
Excerpted Source Code For mdb_cursor_put() From mdb.c
int
mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_val *data,
unsigned int flags)
{
MDB_env *env;
MDB_node *leaf =3D NULL;
MDB_page *fp, *mp, *sub_root =3D NULL;
uint16_t fp_flags;
MDB_val xdata, *rdata, dkey, o=
lddata;
MDB_db dummy;
int do_sub =3D 0, insert_key, insert_data;
unsigned int mcount =3D 0, dcount =3D 0, nospill;
size_t nsize;
int rc, rc2;
unsigned int nflags;
DKBUF;
if (mc =3D=3D NULL || key =3D=3D NULL)
return EINVAL;
env =3D mc->mc_txn->mt_env;
/* Check this first so counter will always be zero on any
* early failures.
*/
if (flags & MDB_MULTIPLE) {
dcount =3D data[1].mv_size;
data[1].mv_size =3D 0;
if (!F_ISSET(mc->mc_db->md_flags, MDB_DUPFI=
XED))
return MDB_INCOMPATIBLE;
}
nospill =3D flags & MDB_NOSPILL;
flags &=3D ~MDB_NOSPILL;
if (mc->mc_txn->mt_flags & (MDB_TXN_RDONLY|MDB_TXN_BLOCKED)=
)
return (mc->mc_txn->mt_flags & MDB_TXN_RDON=
LY) ? EACCES : MDB_BAD_TXN;
if (key->mv_size-1 >=3D ENV_MAXKEY(env))
return MDB_BAD_VALSIZE;
#if SIZE_MAX > MAXDATASIZE
if (data->mv_size > ((mc->mc_db->md_flags & MDB_DUPSORT) ? =
ENV_MAXKEY(env) : MAXDATASIZE))
return MDB_BAD_VALSIZE;
#else
if ((mc->mc_db->md_flags & MDB_DUPSORT) && data->mv_size > =
ENV_MAXKEY(env))
return MDB_BAD_VALSIZE;
#endif
DPRINTF(("=3D=3D> put db %d key [%s], size %"Z"u, data size=
%"Z"u",
DDBI(mc), DKEY(key), key ? key->mv_size : 0=
, data->mv_size));
dkey.mv_size =3D 0;
if (flags =3D=3D MDB_CURRENT) { <-------- false flags =3D 0
if (!(mc->mc_flags & C_INITIALIZED))
return EINVAL;
rc =3D MDB_SUCCESS;
} else if (mc->mc_db->md_root =3D=3D P_INVALID) { <--------=
false, mc->mc_db->md_root =3D 68
/* new database, cursor has nothing to poin=
t to */
mc->mc_snum =3D 0;
mc->mc_top =3D 0;
mc->mc_flags &=3D ~C_INITIALIZED;
rc =3D MDB_NO_ROOT;
} else { <-------- executed
int exact =3D 0;
MDB_val d2;
if (flags & MDB_APPEND) { <-------- false f=
lags =3D 0
MDB_val k2;
rc =3D mdb_cursor_last(mc, =
&k2, &d2);
if (rc =3D=3D 0) {
rc =3D mc->=
mc_dbx->md_cmp(key, &k2);
if (rc > 0)=
{
=
rc =3D MDB_NOTFOUND;
=
mc->mc_ki[mc->mc_top]++;
} else {
=
/* new key is <=3D last key */
=
rc =3D MDB_KEYEXIST;
}
}
} else {<-------- executed
rc =3D mdb_cursor_set(mc, k=
ey, &d2, MDB_SET, &exact); <-------- returns -30798 which is MDB_NOTFOUND
}<-------- executed
if ((flags & MDB_NOOVERWRITE) && rc =3D=3D =
0) { <-------- false flags =3D 0
DPRINTF(("duplicate key [%s=
]", DKEY(key)));
*data =3D d2;
return MDB_KEYEXIST;
}
if (rc && rc !=3D MDB_NOTFOUND) <-------- f=
alse rc =3D MDB_NOTFOUND
return rc;
}<-------- executed
if (mc->mc_flags & C_DEL)
mc->mc_flags ^=3D C_DEL;
/* Cursor is positioned, check for room in the dirty list *=
/
if (!nospill) { <-------- true
if (flags & MDB_MULTIPLE) {
rdata =3D &xdata;
xdata.mv_size =3D data->mv_=
size * dcount;
} else {
rdata =3D data; <-------- e=
xecuted
}
if ((rc2 =3D mdb_page_spill(mc, key, rdata)=
)) <-------- returned 0 or would have returned
return rc2;
}<-------- executed
if (rc =3D=3D MDB_NO_ROOT) { <-------- false
MDB_page *np;
/* new database, write a root leaf page */
DPUTS("allocating new root leaf page");
if ((rc2 =3D mdb_page_new(mc, P_LEAF, 1, &n=
p))) {
return rc2;
}
mdb_cursor_push(mc, np);
mc->mc_db->md_root =3D np->mp_pgno;
mc->mc_db->md_depth++;
*mc->mc_dbflag |=3D DB_DIRTY;
if ((mc->mc_db->md_flags & (MDB_DUPSORT|MDB=
_DUPFIXED))
=3D=3D MDB_DUPFIXED)
np->mp_flags |=3D P_LEAF2;
mc->mc_flags |=3D C_INITIALIZED;
} else {
/* make sure all cursor pages are writable =
*/
rc2 =3D mdb_cursor_touch(mc); <-------- is =
this called and returns 0 because it does not return
if (rc2)
return rc2;
} <-------- executed
insert_key =3D insert_data =3D rc; <-------- rc =3D -30798 =
or MDB_NOTFOUND!
if (insert_key) { <-------- true
/* The key does not exist */
DPRINTF(("inserting key at index %i", mc->m=
c_ki[mc->mc_top]));
if ((mc->mc_db->md_flags & MDB_DUPSORT) &&
LEAFSIZE(key, data) > env->=
me_nodemax) <-------- false since mc->mc_db->md_flags =3D 0
{
/* Too big for a node, inse=
rt in sub-DB. Set up an empty
* "old sub-page" for prep_s=
ubDB to expand to a full page.
*/
fp_flags =3D P_LEAF|P_DIRTY=
;
fp =3D env->me_pbuf;
fp->mp_pad =3D data->mv_siz=
e; /* used if MDB_DUPFIXED */
fp->mp_lower =3D fp->mp_upp=
er =3D (PAGEHDRSZ-PAGEBASE);
olddata.mv_size =3D PAGEHDR=
SZ;
goto prep_subDB;
} <-------- this was not executed, and the =
very long external else contingency below should be skipped!
} else {
/* there's only a key anyway, so this is a =
no-op */
if (IS_LEAF2(mc->mc_pg[mc->mc_top])) {
char *ptr;
unsigned int ksize =3D mc->=
mc_db->md_pad;
if (key->mv_size !=3D ksize=
)
return MDB_=
BAD_VALSIZE;
ptr =3D LEAF2KEY(mc->mc_pg[=
mc->mc_top], mc->mc_ki[mc->mc_top], ksize);
memcpy(ptr, key->mv_data, k=
size);
fix_parent:
/* if overwriting slot 0 of=
leaf, need to
* update branch key if ther=
e is a parent page
*/
if (mc->mc_top && !mc->mc_k=
i[mc->mc_top]) {
unsigned sh=
ort dtop =3D 1;
mc->mc_top-=
-;
/* slot 0 i=
s always an empty key, find real slot */
while (mc->=
mc_top && !mc->mc_ki[mc->mc_top]) {
=
mc->mc_top--;
=
dtop++;
}
if (mc->mc_=
ki[mc->mc_top])
=
rc2 =3D mdb_update_key(mc, key);
else
=
rc2 =3D MDB_SUCCESS;
mc->mc_top =
+=3D dtop;
if (rc2)
=
return rc2;
}
return MDB_SUCCESS;
}
more:
leaf =3D NODEPTR(mc->mc_pg[mc->mc_top], mc-=
>mc_ki[mc->mc_top]);
olddata.mv_size =3D NODEDSZ(leaf);
olddata.mv_data =3D NODEDATA(leaf);
/* DB has dups? */
if (F_ISSET(mc->mc_db->md_flags, MDB_DUPSOR=
T)) {
/* Prepare (sub-)page/sub-D=
B to accept the new item,
* if needed. fp: old sub-p=
age or a header faking
* it. mp: new (sub-)page. =
offset: growth in page
* size. xdata: node data w=
ith new page or DB.
*/
unsigned i, off=
set =3D 0;
mp =3D fp =3D xdata.mv_data=
=3D env->me_pbuf;
mp->mp_pgno =3D mc->mc_pg[m=
c->mc_top]->mp_pgno;
/* Was a single item before=
, must convert now */
if (!F_ISSET(leaf->mn_flags=
, F_DUPDATA)) {
MDB_cmp_fun=
c *dcmp;
/* Just ove=
rwrite the current item */
if (flags =
=3D=3D MDB_CURRENT)
=
goto current;
dcmp =3D mc=
->mc_dbx->md_dcmp;
#if UINT_MAX < SIZE_MAX
if (dcmp =
=3D=3D mdb_cmp_int && olddata.mv_size =3D=3D sizeof(size_t))
=
dcmp =3D mdb_cmp_clong;
#endif
/* does dat=
a match? */
if (!dcmp(d=
ata, &olddata)) {
=
if (flags & (MDB_NODUPDATA|MDB_APPENDDUP))
=
return MDB_KEYEXIST;
=
/* overwrite it */
=
goto current;
}
/* Back up =
original data item */
dkey.mv_siz=
e =3D olddata.mv_size;
dkey.mv_dat=
a =3D memcpy(fp+1, olddata.mv_data, olddata.mv_size);
/* Make sub=
-page header for the dup items, with dummy body */
fp->mp_flag=
s =3D P_LEAF|P_DIRTY|P_SUBP;
fp->mp_lowe=
r =3D (PAGEHDRSZ-PAGEBASE);
xdata.mv_si=
ze =3D PAGEHDRSZ + dkey.mv_size + data->mv_size;
if (mc->mc_=
db->md_flags & MDB_DUPFIXED) {
=
fp->mp_flags |=3D P_LEAF2;
=
fp->mp_pad =3D data->mv_size;
=
xdata.mv_size +=3D 2 * data->mv_size; /* leave space for 2 more *=
/
} else {
=
xdata.mv_size +=3D 2 * (sizeof(indx_t) + NODESIZE) +
=
(dkey.mv_size & 1) + (data->mv_size & 1);
}
fp->mp_uppe=
r =3D xdata.mv_size - PAGEBASE;
olddata.mv_=
size =3D xdata.mv_size; /* pretend olddata is fp */
} else if (leaf->mn_flags &=
F_SUBDATA) {
/* Data is =
on sub-DB, just store it */
flags |=3D =
F_DUPDATA|F_SUBDATA;
goto put_su=
b;
} else {
/* Data is =
on sub-page */
fp =3D oldd=
ata.mv_data;
switch (fla=
gs) {
default:
=
if (!(mc->mc_db->md_flags & MDB_DUPFIXED)) {
=
offset =3D EVEN(NODESIZE + sizeof(indx_t) +
=
data->mv_size);
=
break;
=
}
=
offset =3D fp->mp_pad;
=
if (SIZELEFT(fp) < offset) {
=
offset *=3D 4; /* space for 4 more */
=
break;
=
}
=
/* FALLTHRU: Big enough MDB_DUPFIXED sub-page */
case MDB_CU=
RRENT:
=
fp->mp_flags |=3D P_DIRTY;
=
COPY_PGNO(fp->mp_pgno, mp->mp_pgno);
=
mc->mc_xcursor->mx_cursor.mc_pg[0] =3D fp;
=
flags |=3D F_DUPDATA;
=
goto put_sub;
}
xdata.mv_si=
ze =3D olddata.mv_size + offset;
}
fp_flags =3D fp->mp_flags;
if (NODESIZE + NODEKSZ(leaf=
) + xdata.mv_size > env->me_nodemax) {
=
/* Too big for a sub-page, convert to sub-DB */
=
fp_flags &=3D ~P_SUBP;
prep_subDB:
=
if (mc->mc_db->md_flags & MDB_DUPFIXED) {
=
fp_flags |=3D P_LEAF2;
=
dummy.md_pad =3D fp->mp_pad;
=
dummy.md_flags =3D MDB_DUPFIXED;
=
if (mc->mc_db->md_flags & MDB_INTEGERDUP)
=
dummy.md_flags |=3D MDB_INTEGERKEY;
=
} else {
=
dummy.md_pad =3D 0;
=
dummy.md_flags =3D 0;
=
}
=
dummy.md_depth =3D 1;
=
dummy.md_branch_pages =3D 0;
=
dummy.md_leaf_pages =3D 1;
=
dummy.md_overflow_pages =3D 0;
=
dummy.md_entries =3D NUMKEYS(fp);
=
xdata.mv_size =3D sizeof(MDB_db);
=
xdata.mv_data =3D &dummy;
=
if ((rc =3D mdb_page_alloc(mc, 1, &mp)))
=
return rc;
=
offset =3D env->me_psize - olddata.mv_size;
=
flags |=3D F_DUPDATA|F_SUBDATA;
=
dummy.md_root =3D mp->mp_pgno;
=
sub_root =3D mp;
}
if (mp !=3D fp) {
mp->mp_flag=
s =3D fp_flags | P_DIRTY;
mp->mp_pad =
=3D fp->mp_pad;
mp->mp_lowe=
r =3D fp->mp_lower;
mp->mp_uppe=
r =3D fp->mp_upper + offset;
if (fp_flag=
s & P_LEAF2) {
=
memcpy(METADATA(mp), METADATA(fp), NUMKEYS(fp) * fp->mp_pad);
} else {
=
memcpy((char *)mp + mp->mp_upper + PAGEBASE, (char *)fp + fp->mp_upper=
+ PAGEBASE,
=
olddata.mv_size - fp->mp_upper - PAGEBASE);
=
for (i=3D0; i<NUMKEYS(fp); i++)
=
mp->mp_ptrs[i] =3D fp->mp_ptrs[i] + offset;
}
}
rdata =3D &xdata;
flags |=3D F_DUPDATA;
do_sub =3D 1;
if (!insert_key)
mdb_node_de=
l(mc, 0);
goto new_sub;
}
current:
/* LMDB passes F_SUBDATA in 'flags' to writ=
e a DB record */
if ((leaf->mn_flags ^ flags) & F_SUBDATA)
return MDB_INCOMPATIBLE;
/* overflow page overwrites need special ha=
ndling */
if (F_ISSET(leaf->mn_flags, F_BIGDATA)) { <=
-------- is this taken?
MDB_page *omp;
pgno_t pg;
int level, ovpages, dpages =
=3D OVPAGES(data->mv_size, env->me_psize);
memcpy(&pg, olddata.mv_data=
, sizeof(pg));
if ((rc2 =3D mdb_page_get(m=
c->mc_txn, pg, &omp, &level)) !=3D 0)
return rc2;
ovpages =3D omp->mp_pages;
/* Is the ov page large eno=
ugh? */
if (ovpages >=3D dpages) {
if (!(omp->mp_flags & P_D=
IRTY) &&
(level ||=
(env->me_flags & MDB_WRITEMAP)))
{
rc =3D mdb_=
page_unspill(mc->mc_txn, omp, &omp); <-------- is this taken?
if (rc)
=
return rc;
level =3D 0=
; /* dirty in this txn or clean */
}
/* Is it dirty? */
if (omp->mp_flags & P_DIR=
TY) {
/* yes, ove=
rwrite it. Note in this case we don't
* bother to=
try shrinking the page if the new data
* is smalle=
r than the overflow threshold.
*/
if (level >=
1) {
=
/* It is writable only in a parent txn */
=
size_t sz =3D (size_t) env->me_psize * ovpages, off;
=
MDB_page *np =3D mdb_page_malloc(mc->mc_txn, ovpages);
=
MDB_ID2 id2;
=
if (!np)
=
return ENOMEM;
=
id2.mid =3D pg;
=
id2.mptr =3D np;
=
/* Note - this page is already counted in parent's dirty_room */
=
rc2 =3D mdb_mid2l_insert(mc->mc_txn->mt_u.dirty_list, &id2);
=
mdb_cassert(mc, rc2 =3D=3D 0);
=
if (!(flags & MDB_RESERVE)) {
=
/* Copy end of page, adjusting alignment so
=
* compiler may copy words instead of bytes.
=
*/
=
off =3D (PAGEHDRSZ + data->mv_size) & -sizeof(size_t);
=
memcpy((size_t *)((char *)np + off),
=
(size_t *)((char *)omp + off), sz - of=
f);
=
sz =3D PAGEHDRSZ;
=
}
=
memcpy(np, omp, sz); /* Copy beginning of page */
=
omp =3D np;
}
SETDSZ(leaf=
, data->mv_size);
if (F_ISSET=
(flags, MDB_RESERVE))
=
data->mv_data =3D METADATA(omp);
else
=
memcpy(METADATA(omp), data->mv_data, data->mv_size);
return MDB_=
SUCCESS;
}
}
if ((rc2 =3D mdb_ovpage_fre=
e(mc, omp)) !=3D MDB_SUCCESS)
return rc2;
} else if (data->mv_size =3D=3D olddata.mv_=
size) {
/* same size, just replace =
it. Note that we could
* also reuse this node if t=
he new data is smaller,
* but instead we opt to shr=
ink the node in that case.
*/
if (F_ISSET(flags, MDB_RESE=
RVE))
data->mv_da=
ta =3D olddata.mv_data;
else if (!(mc->mc_flags & C=
_SUB))
memcpy(oldd=
ata.mv_data, data->mv_data, data->mv_size);
else {
memcpy(NODE=
KEY(leaf), key->mv_data, key->mv_size);
goto fix_pa=
rent;
}
return MDB_SUCCESS;
}
mdb_node_del(mc, 0);
} <-------- This entire else contingency was likely skipped=
!!
rdata =3D data;
new_sub:
nflags =3D flags & NODE_ADD_FLAGS;
nsize =3D IS_LEAF2(mc->mc_pg[mc->mc_top]) ? key->mv_size : =
mdb_leaf_size(env, key, rdata); <-------- SEGV
...
This may be an identifiable bug in mdb_cursor_put() as It does not safely h=
andle the case when the noted call to mdb_cursor_set() returns MDB_NOTFOUND=
(-30798)!
It explicitly fails to preemptively exit by returning an error in this case=
.
The value of -30798 is in turn assigned to insert_key, which is therefore n=
on-null in the condition of the subsequent if statement.
insert_key =3D insert_data =3D rc; <-------- insert_key =3D=
-30798 or MDB_NOTFOUND!
if (insert_key) { <-------- true
/* The key does not exist */
DPRINTF(("inserting key at index %i", mc->m=
c_ki[mc->mc_top]));
if ((mc->mc_db->md_flags & MDB_DUPSORT) &&
LEAFSIZE(key, data) > env->=
me_nodemax) <-------- false since mc->mc_db->md_flags =3D 0
{
/* Too big for a node, inse=
rt in sub-DB. Set up an empty
* "old sub-page" for prep_s=
ubDB to expand to a full page.
*/
fp_flags =3D P_LEAF|P_DIRTY=
;
fp =3D env->me_pbuf;
fp->mp_pad =3D data->mv_siz=
e; /* used if MDB_DUPFIXED */
fp->mp_lower =3D fp->mp_upp=
er =3D (PAGEHDRSZ-PAGEBASE);
olddata.mv_size =3D PAGEHDR=
SZ;
goto prep_subDB;
} <-------- this was not executed, and the =
very long else contingency below is skipped!
} else {
Since mc->mc_db->md_flags =3D 0, the contingency in the embedded if stateme=
nt fails.
The segmentation fault occurs due to the call of IS_LEAF2 on the null point=
er mc->mc_pg[0].
rdata =3D data;
new_sub:
nflags =3D flags & NODE_ADD_FLAGS;
nsize =3D IS_LEAF2(mc->mc_pg[mc->mc_top]) ? key->mv_size : =
mdb_leaf_size(env, key, rdata); <-------- SEGV
Regards,
Robins.
--_000_MN2PR06MB55017A7261FA27380778753BAFEA0MN2PR06MB5501namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml"; xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoPlainText"><repost since the previous message came as 64 =
encoded, apologies><o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Hello Howard,<o:p></o:p></p>
<p class=3D"MsoPlainText">we are not able to reproduce the issue consistent=
ly so test code is not available at this time, and I do believe this issue =
will be present in the latest code as well since Myk also reported the same=
.. Attaching analysis from our side,
hope it helps.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">The call stack what we have seen is,<o:p></o:p></=
p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> #0 0x0011b62e in mdb_cursor_pu=
t (mc=3D0xffe52d18, key=3D0xffe52e74, data=3D0xffe52e6c, flags=3D0) at mdb.=
c:6688<o:p></o:p></p>
<p class=3D"MsoPlainText"> #1 0x0011c8ec in mdb_put (txn=
=3D0xdc13f008, dbi=3D2, key=3D0xffe52e74, data=3D0xffe52e6c, flags=3D0) at =
mdb.c:8771<o:p></o:p></p>
<p class=3D"MsoPlainText"> #2 0x00b792b8 in LMDB::LMDBCon=
text::createSession (this=3D0x80ca418, sid=3D0x8297be4 "sidebf3708f0fd=
9fcb8e062529da47adf51402dfc4600000000+") at lmdbint.cc:460<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> #3 0x08053564 in updateLMDB (r=
equest=3D..., forward=3D@0xffe5315f) at sessionserver.cc:1075<o:p></o:p></p=
>
<p class=3D"MsoPlainText"> #4 processRequestWithoutRespon=
se (request=3D..., forward=3D@0xffe5315f) at sessionserver.cc:1160<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> #5 0x08056a80 in processReques=
t (this=3D0x80b2ac0, fd=3D33) at sessionserver.cc:1189<o:p></o:p></p>
<p class=3D"MsoPlainText"> #6 readFromSock (this=3D0x80b2=
ac0, fd=3D33) at sessionserver.cc:1342<o:p></o:p></p>
<p class=3D"MsoPlainText"> #7 SockHandler::ioReady (this=
=3D0x80b2ac0, fd=3D33) at sessionserver.cc:1455<o:p></o:p></p>
<p class=3D"MsoPlainText"> #8 0x00ba2592 in runCoreDispat=
cher (default_t=3D<value optimized out>, flags=3D-1) at fds.cc:889<o:=
p></o:p></p>
<p class=3D"MsoPlainText"> #9 0x00ba2ff7 in DSEvntFds::ru=
nDispatcher () at fds.cc:945<o:p></o:p></p>
<p class=3D"MsoPlainText"> #10 0x080559c6 in main () at s=
essionserver.cc:1739<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Here it is helpful to examine frames #0 and #1 in=
detail in relation to the relevant source code /libraries/liblmdb/mdb.c.<o=
:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Frame #1<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">#1 0x0011c8ec in mdb_put (txn=3D0xdc13f008,=
dbi=3D2, key=3D0xffe52e74, data=3D0xffe52e6c, flags=3D0) at mdb.c:8771<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> mc =3D=
{mc_next =3D 0x0, mc_backup =3D 0x0, mc_xcursor =3D 0x0, mc_txn =3D 0xdc13=
f008, mc_dbi =3D 2, mc_db =3D 0xdc13f088, mc_dbx =3D 0xe1215038, mc_dbflag =
=3D 0xdc1cf09a "\033", '\032' <repeats 51 times>, mc_snum =
=3D 0, mc_top =3D 0, mc_flags =3D 0,
mc_pg =3D {0x0, 0x80b2ac0, 0xffe52d68, 0x28afce, 0xdc13f008, 0x80ce9b0, 0x=
ffe52dc8, 0x4c5ff4, 0x2b, 0x80b2ac0, 0xffe52d98, 0x49209a, 0x2b, 0x4c5ff4, =
0x2121cb, 0x21576c, 0x8297d34, 0x3497af, 0x21576c, 0x21316a, 0x8297d34, 0x8=
0ac7b0, 0x1e, 0x46eed6, 0x2b, 0x0,
0x80ce9b0, 0x4c5ff4, 0x80ac7b0, 0x8297d34, 0xffe52df8, 0x46fb96}, mc_ki =
=3D {0, 2089, 51120, 2058, 30, 0, 16796, 17, 11760, 65509, 3, 0, 32040, 208=
9, 30, 0, 0, 0, 0, 0, 3, 0, 24564, 76, 51120, 2058, 10944, 2059, 11800, 655=
09, 64758, 70}} <--------<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; <o:p></o:p></p>
<p class=3D"MsoPlainText"> mx =3D=
{mx_cursor =3D {mc_next =3D 0x38, mc_backup =3D 0x3, mc_xcursor =3D 0x0, m=
c_txn =3D 0x0, mc_dbi =3D 0, mc_db =3D 0x28, mc_dbx =3D 0x0, mc_dbflag =3D =
0x0, mc_snum =3D 3, mc_top =3D 0, mc_flags =3D 17, mc_pg =3D {0x3a93d8, 0x1=
0, 0x0, 0x18, 0x3a93a0,
0x0, 0x3a93d0, 0x289abe, 0x3a93a0, 0xffe52d3f, 0xffe52c68, 0x28afce, 0xffe=
52dbc, 0xffe52db4, 0x3, 0x4c5ff4, 0x11, 0x36c99b, 0x6e, 0x77, 0x7c, 0x5b, 0=
x38, 0x289abe, 0x0, 0x0, 0x0, 0x28, 0x0, 0x0, 0x3, 0x10}, mc_ki =3D {37848,=
58, 51611, 54, 110, 0, 119, 0, 124,
0, 91, 0, 58, 0, 39614, 40, 0, 0, 0, 0, 0, 0, 160, 0, 0, 0, 2, 0, 18, 0, 1=
36, 0}}, mx_db =3D {md_pad =3D 3838936, md_flags =3D 51611, md_depth =3D 54=
, md_branch_pages =3D 110, md_leaf_pages =3D 119, md_overflow_pages =3D 124=
, md_entries =3D 91, md_root =3D 56}, mx_dbx =3D {md_name
=3D {mv_size =3D 6, mv_data =3D 0x0}, md_cmp =3D 0, md_dcmp =3D 0, md_rel =
=3D 0x40, md_relctx =3D 0x0}, mx_dbflag =3D 0 '\000'}<o:p></o:p></p>
<p class=3D"MsoPlainText"> rc =3D=
0 <o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">And source code for mdb_put() is from mdb.c<o:p><=
/o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">int<o:p></o:p></p>
<p class=3D"MsoPlainText">mdb_put(MDB_txn *txn, MDB_dbi dbi,<o:p></o:p></p>
<p class=3D"MsoPlainText"> MDB_val *key, MDB_val *data, u=
nsigned int flags) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_cursor mc;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_xcursor mx;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; int rc;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (!key || !data || !TXN_DBI_EXI=
ST(txn, dbi, DB_USRVALID))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return EINVA=
L;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (flags & ~(MDB_NOOVERWRITE=
|MDB_NODUPDATA|MDB_RESERVE|MDB_APPEND|MDB_APPENDDUP))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return EINVA=
L;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (txn->mt_flags & (MDB_T=
XN_RDONLY|MDB_TXN_BLOCKED))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return (txn-=
>mt_flags & MDB_TXN_RDONLY) ? EACCES : MDB_BAD_TXN;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mdb_cursor_init(&mc, txn, dbi=
, &mx); <-------- see source code below<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc.mc_next =3D txn->mt_cursors=
[dbi];<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; txn->mt_cursors[dbi] =3D &=
mc;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; rc =3D mdb_cursor_put(&mc, ke=
y, data, flags); <-------- see Frame #0<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; txn->mt_cursors[dbi] =3D mc.mc=
_next;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; return rc;<o:p></o:p></p>
<p class=3D"MsoPlainText">}<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Source Code For mdb_cursor_init() From mdb.c<o:p>=
</o:p></p>
<p class=3D"MsoPlainText">/** Initialize a cursor for a given transaction a=
nd database. */ static void mdb_cursor_init(MDB_cursor *mc, MDB_txn *txn, M=
DB_dbi dbi, MDB_xcursor *mx) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_next =3D NULL;<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_backup =3D NULL;<o:p></=
o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_dbi =3D dbi;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_txn =3D txn;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_db =3D &txn->mt_=
dbs[dbi];<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_dbx =3D &txn->mt=
_dbxs[dbi];<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_dbflag =3D &txn->=
;mt_dbflags[dbi];<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_snum =3D 0; <-------=
- <o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_top =3D 0; <--------=
<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_pg[0] =3D 0; <------=
-- <o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_ki[0] =3D 0;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_flags =3D 0;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; if (txn->mt_dbs[dbi].md_flags =
& MDB_DUPSORT) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mdb_tassert(=
txn, mx !=3D NULL);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_xc=
ursor =3D mx;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mdb_xcursor_=
init0(mc);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_xc=
ursor =3D NULL;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (*mc->mc_dbflag & DB_ST=
ALE) { <-------- false *mc->mc_dbflag =3D 27, DB_STALE =3D 0x02 =
&nb=
sp; /**< Named-DB record is older than txnID */<o:p></=
o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mdb_page_sea=
rch(mc, NULL, MDB_PS_ROOTONLY);
<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText">}<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">From this we know that when mdb_cursor_put() is c=
alled, the following values remain assigned:<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_snum =3D 0; <--------<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_top =3D 0; <--------=
<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; mc->mc_pg[0] =3D 0; <------=
-- <o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">and its noted these two values still have their i=
nitial values at the time of the segmentation fault.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">(gdb) fr 0<o:p></o:p></p>
<p class=3D"MsoPlainText">#0 0x0011b62e in mdb_cursor_put (mc=3D0xffe52d18,=
key=3D0xffe52e74, data=3D0xffe52e6c, flags=3D0) at mdb.c:6688<o:p></o:p></=
p>
<p class=3D"MsoPlainText">6688 in mdb.c<o:p></o:p></p>
<p class=3D"MsoPlainText">(gdb) p mc->mc_top<o:p></o:p></p>
<p class=3D"MsoPlainText">$1 =3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText">(gdb) p mc->mc_pg[mc->mc_top]<o:p></o:p></p=
>
<p class=3D"MsoPlainText">$19 =3D (MDB_page *) 0x0<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Let us consider how the path taken through mdb_cu=
rsor_put() could account for these null variable values which result in a s=
egmentation fault.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Frame #0<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">#0 0x0011b62e in mdb_cursor_put (mc=3D0xffe=
52d18, key=3D0xffe52e74, data=3D0xffe52e6c, flags=3D0) at mdb.c:6688 <--=
------ flags =3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> env =
=3D 0x80ce9b0<o:p></o:p></p>
<p class=3D"MsoPlainText"> leaf =
=3D <value optimized out><o:p></o:p></p>
<p class=3D"MsoPlainText"> fp =3D=
<value optimized out><o:p></o:p></p>
<p class=3D"MsoPlainText"> mp =3D=
0x38<o:p></o:p></p>
<p class=3D"MsoPlainText"> sub_ro=
ot =3D 0x0 <o:p></o:p></p>
<p class=3D"MsoPlainText"> f=
p_flags =3D <value optimized out><o:p></o:p></p>
<p class=3D"MsoPlainText"> xdata =
=3D {mv_size =3D 3838880, mv_data =3D 0xdc1cf09a}<o:p></o:p></p>
<p class=3D"MsoPlainText"> rdata =
=3D 0xffe52e6c<o:p></o:p></p>
<p class=3D"MsoPlainText"> dkey =
=3D {mv_size =3D 0, mv_data =3D 0x3a93cc}<o:p></o:p></p>
<p class=3D"MsoPlainText"> olddat=
a =3D {mv_size =3D 22, mv_data =3D 0x36c820}<o:p></o:p></p>
<p class=3D"MsoPlainText"> dummy =
=3D {md_pad =3D 22, md_flags =3D 11128, md_depth =3D 65509, md_branch_pages=
=3D 16, md_leaf_pages =3D 1507329, md_overflow_pages =3D 0, md_entries =3D=
3838928, md_root =3D 3833844}<o:p></o:p></p>
<p class=3D"MsoPlainText"> do_sub=
=3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> insert=
_key =3D -30798 <-------- #define MDB_NOTFOUND &n=
bsp; (-30798)<o:p></o:p></p>
<p class=3D"MsoPlainText"> insert=
_data =3D -30798 <-------- #define MDB_NOTFOUND &=
nbsp; (-30798)<o:p></o:p></p>
<p class=3D"MsoPlainText"> mcount=
=3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> dcount=
=3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> nospil=
l =3D 0 <--------<o:p></o:p></p>
<p class=3D"MsoPlainText"> nsize =
=3D <value optimized out><o:p></o:p></p>
<p class=3D"MsoPlainText"> rc =3D=
0 <o:p></o:p></p>
<p class=3D"MsoPlainText"> r=
c2 =3D <value optimized out><o:p></o:p></p>
<p class=3D"MsoPlainText"> nflags=
=3D 0 <--------<o:p></o:p></p>
<p class=3D"MsoPlainText"> __func=
__ =3D "mdb_cursor_put" =
<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">We know that mc->mc_top and mc->mc_pg[0] we=
re initialized to 0 in mdb_cursor_init(). As my annotations of the source c=
ode below suggest, careful analysis reveals that the paths actually taken t=
hrough mdb_cursor_put() do not modify these
assignments.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">Excerpted Source Code For mdb_cursor_put() From m=
db.c<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">int<o:p></o:p></p>
<p class=3D"MsoPlainText">mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_=
val *data,<o:p></o:p></p>
<p class=3D"MsoPlainText"> unsigned int flags)<o:p></o:p>=
</p>
<p class=3D"MsoPlainText">{<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_env &n=
bsp;  =
; *env;<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_node &=
nbsp; *leaf =3D NULL;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_page &=
nbsp; *fp, *mp, *sub_root =3D NULL;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; uint16_t &=
nbsp; fp_flags;<o:p><=
/o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_val &n=
bsp;  =
; x=
data, *rdata, dkey, olddata;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; MDB_db dummy;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; int do_sub =3D 0, insert_key, ins=
ert_data;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; unsigned int mcount =3D 0, dcount=
=3D 0, nospill;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; size_t nsize;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; int rc, rc2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; unsigned int nflags;<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; DKBUF;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (mc =3D=3D NULL || key =3D=3D =
NULL)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return EINVA=
L;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; env =3D mc->mc_txn->mt_env;=
<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; /* Check this first so counter wi=
ll always be zero on any<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; * early failures.<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (flags & MDB_MULTIPLE) {<o=
:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; dcount =3D d=
ata[1].mv_size;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; data[1].mv_s=
ize =3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (!F_ISSET=
(mc->mc_db->md_flags, MDB_DUPFIXED))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return MDB_INCOMPATIBLE;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; nospill =3D flags & MDB_NOSPI=
LL;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; flags &=3D ~MDB_NOSPILL;<o:p>=
</o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (mc->mc_txn->mt_flags &a=
mp; (MDB_TXN_RDONLY|MDB_TXN_BLOCKED))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return (mc-&=
gt;mc_txn->mt_flags & MDB_TXN_RDONLY) ? EACCES : MDB_BAD_TXN;<o:p></=
o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (key->mv_size-1 >=3D ENV=
_MAXKEY(env))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return MDB_B=
AD_VALSIZE;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">#if SIZE_MAX > MAXDATASIZE<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (data->mv_size > ((mc-&g=
t;mc_db->md_flags & MDB_DUPSORT) ? ENV_MAXKEY(env) : MAXDATASIZE))<o=
:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return MDB_B=
AD_VALSIZE;<o:p></o:p></p>
<p class=3D"MsoPlainText">#else<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if ((mc->mc_db->md_flags &a=
mp; MDB_DUPSORT) && data->mv_size > ENV_MAXKEY(env))<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; return MDB_B=
AD_VALSIZE;<o:p></o:p></p>
<p class=3D"MsoPlainText">#endif<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; DPRINTF(("=3D=3D> put db =
%d key [%s], size %"Z"u, data size %"Z"u",<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; DDBI(mc), DK=
EY(key), key ? key->mv_size : 0, data->mv_size));<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; dkey.mv_size =3D 0;<o:p></o:p></p=
>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (flags =3D=3D MDB_CURRENT) { &=
lt;-------- false flags =3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (!(mc->=
;mc_flags & C_INITIALIZED))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; =
&nb=
sp; return EINVAL;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; rc =3D MDB_S=
UCCESS;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } else if (mc->mc_db->md_ro=
ot =3D=3D P_INVALID) { <-------- false, mc->mc_db->md_root =3D 68<=
o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* new datab=
ase, cursor has nothing to point to */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_sn=
um =3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_to=
p =3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_fl=
ags &=3D ~C_INITIALIZED;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; rc =3D MDB_N=
O_ROOT; <o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } else { <-------- executed<o:=
p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; int exact =
=3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; MDB_val d2;<=
o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (flags &a=
mp; MDB_APPEND) { <-------- false flags =3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; MDB_val k2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc =3D mdb_cursor_last(mc, &k2, &d2);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (rc =3D=3D 0) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; rc =3D mc->mc_dbx->md_cmp(key, &k2)=
;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (rc > 0) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc =3D MDB_NOTFOUND;<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; mc->mc_ki[mc->mc_t=
op]++;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* new key is <=3D la=
st key */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc =3D MDB_KEYEXIST;<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; } else {<=
-------- executed<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc =3D mdb_cursor_set(mc, key, &d2, MDB_SET, &exact); <=
-------- returns -30798 which is MDB_NOTFOUND<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<-------=
- executed<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((flags &=
amp; MDB_NOOVERWRITE) && rc =3D=3D 0) { <-------- false flags =
=3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; DPRINTF(("duplicate key [%s]", DKEY(key)));<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; *data =3D d2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return MDB_KEYEXIST;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (rc &=
& rc !=3D MDB_NOTFOUND) <-------- false rc =3D MDB_NOTFOUND<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return rc;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; }<-------- executed<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (mc->mc_flags & C_DEL)<=
o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_fl=
ags ^=3D C_DEL;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; /* Cursor is positioned, check fo=
r room in the dirty list */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (!nospill) { <-------- true=
<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (flags &a=
mp; MDB_MULTIPLE) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rdata =3D &xdata;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; xdata.mv_size =3D data->mv_size * dcount;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; } else {<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rdata =3D data; <-------- executed<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((rc2 =3D=
mdb_page_spill(mc, key, rdata))) <-------- returned 0 or would have ret=
urned<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return rc2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; }<-------- executed<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (rc =3D=3D MDB_NO_ROOT) { <=
-------- false <o:p>
</o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; MDB_page *np=
;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* new datab=
ase, write a root leaf page */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; DPUTS("=
allocating new root leaf page");<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((rc2 =3D=
mdb_page_new(mc, P_LEAF, 1, &np))) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return rc2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mdb_cursor_p=
ush(mc, np);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_db=
->md_root =3D np->mp_pgno;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_db=
->md_depth++;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; *mc->mc_d=
bflag |=3D DB_DIRTY;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((mc->=
mc_db->md_flags & (MDB_DUPSORT|MDB_DUPFIXED))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; =3D=3D MDB_DUPFIXED)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; np->mp_flags |=3D P_LEAF2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mc->mc_fl=
ags |=3D C_INITIALIZED;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* make sure=
all cursor pages are writable */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; rc2 =3D mdb_=
cursor_touch(mc); <-------- is this called and returns 0 because it does=
not return<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (rc2)<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return rc2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } <-------- executed<o:p></o:p=
></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; insert_key =3D insert_data =3D rc=
; <-------- rc =3D -30798 or MDB_NOTFOUND!<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (insert_key) { <-------- tr=
ue<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* The key d=
oes not exist */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; DPRINTF((&qu=
ot;inserting key at index %i", mc->mc_ki[mc->mc_top]));<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((mc->=
mc_db->md_flags & MDB_DUPSORT) &&<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; LEAFSIZE(key, data) > env->me_nodemax) <-------- false si=
nce mc->mc_db->md_flags =3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; {<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Too big for a node, insert in sub-DB. Set up an empty<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * "old sub-page" for prep_subDB to expand to a full page=
.<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp_flags =3D P_LEAF|P_DIRTY;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp =3D env->me_pbuf;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_pad =3D data->mv_size; /* used if MDB_DUPFIXED */<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_lower =3D fp->mp_upper =3D (PAGEHDRSZ-PAGEBASE);<o:p>=
</o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; olddata.mv_size =3D PAGEHDRSZ;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; goto prep_subDB;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; } <------=
-- this was not executed, and the very long external else contingency below=
should be skipped!<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* there's o=
nly a key anyway, so this is a no-op */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (IS_LEAF2=
(mc->mc_pg[mc->mc_top])) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; char *ptr;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; unsigned int ksize =3D mc->mc_db->md_pad;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (key->mv_size !=3D ksize)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; return MDB_BAD_VALSIZE;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; ptr =3D LEAF2KEY(mc->mc_pg[mc->mc_top], mc->mc_ki[mc->=
mc_top], ksize);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; memcpy(ptr, key->mv_data, ksize);<o:p></o:p></p>
<p class=3D"MsoPlainText">fix_parent:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* if overwriting slot 0 of leaf, need to<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * update branch key if there is a parent page<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (mc->mc_top && !mc->mc_ki[mc->mc_top]) {<o:p><=
/o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; unsigned short dtop =3D 1;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mc->mc_top--;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* slot 0 is always an empty key, find real s=
lot */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; while (mc->mc_top && !mc->mc_ki=
[mc->mc_top]) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; mc->mc_top--;<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dtop++;<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (mc->mc_ki[mc->mc_top])<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc2 =3D mdb_update_key(m=
c, key);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; else<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc2 =3D MDB_SUCCESS;<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mc->mc_top +=3D dtop;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (rc2)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return rc2;<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return MDB_SUCCESS;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">more:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; leaf =3D NOD=
EPTR(mc->mc_pg[mc->mc_top], mc->mc_ki[mc->mc_top]);<o:p></o:p><=
/p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; olddata.mv_s=
ize =3D NODEDSZ(leaf);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; olddata.mv_d=
ata =3D NODEDATA(leaf);<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* DB has du=
ps? */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (F_ISSET(=
mc->mc_db->md_flags, MDB_DUPSORT)) {
<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Prepare (sub-)page/sub-DB to accept the new item,<o:p></o:p></p=
>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * if needed. fp: old sub-page or a header faking<o:p></o:p><=
/p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * it. mp: new (sub-)page. offset: growth in page<o:p><=
/o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * size. xdata: node data with new page or DB.<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; unsigned &nbs=
p; i, offset =3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; mp =3D fp =3D xdata.mv_data =3D env->me_pbuf;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; mp->mp_pgno =3D mc->mc_pg[mc->mc_top]->mp_pgno;<o:p></=
o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Was a single item before, must convert now */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (!F_ISSET(leaf->mn_flags, F_DUPDATA)) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; MDB_cmp_func *dcmp;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* Just overwrite the current item */<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (flags =3D=3D MDB_CURRENT)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; goto current;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dcmp =3D mc->mc_dbx->md_dcmp;<o:p></o:p=
></p>
<p class=3D"MsoPlainText">#if UINT_MAX < SIZE_MAX<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (dcmp =3D=3D mdb_cmp_int && olddat=
a.mv_size =3D=3D sizeof(size_t))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dcmp =3D mdb_cmp_clong;<=
o:p></o:p></p>
<p class=3D"MsoPlainText">#endif<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* does data match? */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (!dcmp(data, &olddata)) {<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (flags & (MDB_NOD=
UPDATA|MDB_APPENDDUP))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; ret=
urn MDB_KEYEXIST;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* overwrite it */<o:p><=
/o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; goto current;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* Back up original data item */<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dkey.mv_size =3D olddata.mv_size;<o:p></o:p><=
/p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dkey.mv_data =3D memcpy(fp+1, olddata.mv_=
data, olddata.mv_size);<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* Make sub-page header for the dup items, wi=
th dummy body */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; fp->mp_flags =3D P_LEAF|P_DIRTY|P_SUBP;<o:=
p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; fp->mp_lower =3D (PAGEHDRSZ-PAGEBASE);<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; xdata.mv_size =3D PAGEHDRSZ + dkey.mv_siz=
e + data->mv_size;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; =
&nb=
sp; =
if (mc->mc_db->md_flags & MDB_DUPFIXED) =
{<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_flags |=3D P_L=
EAF2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_pad =3D data-&=
gt;mv_size;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; xdata.mv_size +=3D 2=
* data->mv_size; /* leave space for 2 mor=
e */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; xdata.mv_size +=3D 2=
* (sizeof(indx_t) + NODESIZE) +<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; (dk=
ey.mv_size & 1) + (data->mv_size & 1);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; fp->mp_upper =3D xdata.mv_size - PAGEBASE;=
<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; olddata.mv_size =3D xdata.mv_size; /* pretend=
olddata is fp */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; } else if (leaf->mn_flags & F_SUBDATA) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* Data is on sub-DB, just store it */<o:p></=
o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; flags |=3D F_DUPDATA|F_SUBDATA;<o:p></o:p></p=
>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; goto put_sub;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* Data is on sub-page */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; fp =3D olddata.mv_data;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; switch (flags) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; default:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (!(mc->mc_db->m=
d_flags & MDB_DUPFIXED)) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; off=
set =3D EVEN(NODESIZE + sizeof(indx_t) +<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; data->mv_size);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; bre=
ak;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; offset =3D fp->mp_pad=
;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (SIZELEFT(fp) < of=
fset) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; off=
set *=3D 4; /* space for 4 more */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; bre=
ak;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* FALLTHRU: Big enough =
MDB_DUPFIXED sub-page */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; case MDB_CURRENT:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_flags |=3D P_D=
IRTY;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; COPY_PGNO(fp->mp_pgno=
, mp->mp_pgno);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; mc->mc_xcursor->mx=
_cursor.mc_pg[0] =3D fp;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; flags |=3D F_DUPDATA;<o:=
p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; goto put_sub;<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; xdata.mv_size =3D olddata.mv_size + offse=
t;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp_flags =3D fp->mp_flags;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (NODESIZE + NODEKSZ(leaf) + xdata.mv_size > env->=
me_nodemax) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Too big for a sub-pag=
e, convert to sub-DB */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp_flags &=3D ~P_SUB=
P;<o:p></o:p></p>
<p class=3D"MsoPlainText">prep_subDB:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (mc->mc_db->md_=
flags & MDB_DUPFIXED) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; fp_=
flags |=3D P_LEAF2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dum=
my.md_pad =3D fp->mp_pad;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dum=
my.md_flags =3D MDB_DUPFIXED;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if =
(mc->mc_db->md_flags & MDB_INTEGERDUP)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dummy.md_flags |=3D MDB_INTEGERKEY;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dum=
my.md_pad =3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; dum=
my.md_flags =3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dummy.md_depth =3D 1;<o:=
p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dummy.md_branch_pages =
=3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; =
&nb=
sp; =
&nb=
sp; dummy.md_leaf_pages =3D 1;<o:=
p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dummy.md_overflow_pages =
=3D 0;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dummy.md_entries =3D NUM=
KEYS(fp);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; xdata.mv_size =3D sizeof=
(MDB_db);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; xdata.mv_data =3D &d=
ummy;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if ((rc =3D mdb_page_all=
oc(mc, 1, &mp)))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; ret=
urn rc;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; offset =3D env->me_ps=
ize - olddata.mv_size;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; flags |=3D F_DUPDATA|F_S=
UBDATA;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; dummy.md_root =3D mp->=
;mp_pgno;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; sub_root =3D mp;<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (mp !=3D fp) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mp->mp_flags =3D fp_flags | P_DIRTY;<o:p><=
/o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mp->mp_pad =3D fp->mp_pad;<=
o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mp->mp_lower =3D fp->mp_lower;<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mp->mp_upper =3D fp->mp_upper + off=
set;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (fp_flags & P_LEAF2) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; memcpy(METADATA(mp), MET=
ADATA(fp), NUMKEYS(fp) * fp->mp_pad);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; memcpy((char *)mp + =
mp->mp_upper + PAGEBASE, (char *)fp + fp->mp_upper + PAGE=
BASE,<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; old=
data.mv_size - fp->mp_upper - PAGEBASE);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; for (i=3D0; i<NUMKEYS=
(fp); i++)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mp-=
>mp_ptrs[i] =3D fp->mp_ptrs[i] + offset;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rdata =3D &xdata;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; flags |=3D F_DUPDATA;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; do_sub =3D 1;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (!insert_key)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mdb_node_del(mc, 0);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; goto new_sub;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<o:p></o:p>=
</p>
<p class=3D"MsoPlainText">current:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* LMDB pass=
es F_SUBDATA in 'flags' to write a DB record */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((leaf-&g=
t;mn_flags ^ flags) & F_SUBDATA)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return MDB_INCOMPATIBLE;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* overflow =
page overwrites need special handling */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if (F_ISSET(=
leaf->mn_flags, F_BIGDATA)) { <-------- is this taken?<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; MDB_page *omp;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; pgno_t pg;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; int level, ovpages, dpages =3D OVPAGES(data->mv_size, env->m=
e_psize);<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; memcpy(&pg, olddata.mv_data, sizeof(pg));<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if ((rc2 =3D mdb_page_get(mc->mc_txn, pg, &omp, &level)=
) !=3D 0)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; return rc2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; ovpages =3D omp->mp_pages;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Is the ov page large enough? */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (ovpages >=3D dpages) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (!(omp->mp_flags & P_DIRTY) &&<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; (level || (env->me_flags & MDB_=
WRITEMAP)))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; rc =3D mdb_page_unspill(mc->mc_txn, omp, &=
amp;omp); <-------- is this taken?<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (rc)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return rc;<o:p></o:p></p=
>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; level =3D 0; &nb=
sp; =
/* dirty=
in this txn or clean */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Is it dirty? */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (omp->mp_flags & P_DIRTY) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* yes, overwrite it. Note in this case we do=
n't<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; * bother to try shrinking the page if the new=
data<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; * is smaller than the overflow threshold.<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (level > 1) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* It is writable only i=
n a parent txn */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; size_t sz =3D (size_t) e=
nv->me_psize * ovpages, off;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; MDB_page *np =3D mdb_pag=
e_malloc(mc->mc_txn, ovpages);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; MDB_ID2 id2;<o:p></o:p><=
/p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (!np)<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; ret=
urn ENOMEM;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; id2.mid =3D pg;<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; id2.mptr =3D np;<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Note - this page is a=
lready counted in parent's dirty_room */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; rc2 =3D mdb_mid2l_insert=
(mc->mc_txn->mt_u.dirty_list, &id2);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; mdb_cassert(mc, rc2 =3D=
=3D 0);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (!(flags & MDB_RE=
SERVE)) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; /* =
Copy end of page, adjusting alignment so<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; * c=
ompiler may copy words instead of bytes.<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; */<=
o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; off=
=3D (PAGEHDRSZ + data->mv_size) & -sizeof(size_t);<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; mem=
cpy((size_t *)((char *)np + off),<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; (size_t *)((char *)omp + off), sz - off);<o:p></o:p><=
/p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; sz =
=3D PAGEHDRSZ;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; memcpy(np, omp, sz); /* =
Copy beginning of page */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; omp =3D np;<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; SETDSZ(leaf, data->mv_size);<o:p></o:p></p=
>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; if (F_ISSET(flags, MDB_RESERVE))<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; data->mv_data =3D MET=
ADATA(omp);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; else<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; memcpy(METADATA(omp), da=
ta->mv_data, data->mv_size);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; return MDB_SUCCESS;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if ((rc2 =3D mdb_ovpage_free(mc, omp)) !=3D MDB_SUCCESS)<o:p></o:p=
></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; return rc2;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; } else if (d=
ata->mv_size =3D=3D olddata.mv_size) {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* same size, just replace it. Note that we could<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * also reuse this node if the new data is smaller,<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * but instead we opt to shrink the node in that case.<o:p></o:p></=
p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; if (F_ISSET(flags, MDB_RESERVE))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; data->mv_data =3D olddata.mv_data;<o:p></o=
:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; else if (!(mc->mc_flags & C_SUB))<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; memcpy(olddata.mv_data, data->mv_data, dat=
a->mv_size);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; else {<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; memcpy(NODEKEY(leaf), key->mv_data, key-&g=
t;mv_size);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; &=
nbsp; goto fix_parent;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; }<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; return MDB_SUCCESS;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; }<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; mdb_node_del=
(mc, 0);<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } <-------- This entire else c=
ontingency was likely skipped!!<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; rdata =3D data;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">new_sub:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; nflags =3D flags & NODE_ADD_F=
LAGS;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; nsize =3D IS_LEAF2(mc->mc_pg[m=
c->mc_top]) ? key->mv_size : mdb_leaf_size(env, key, rdata); <----=
---- SEGV<o:p></o:p></p>
<p class=3D"MsoPlainText">... &nbs=
p; <o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">This may be an identifiable bug in mdb_cursor_put=
() as It does not safely handle the case when the noted call to mdb_cursor_=
set() returns MDB_NOTFOUND (-30798)!<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">It explicitly fails to preemptively exit by retur=
ning an error in this case.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">The value of -30798 is in turn assigned to insert=
_key, which is therefore non-null in the condition of the subsequent if sta=
tement.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; insert_key =3D insert_data =3D rc=
; <-------- insert_key =3D -30798 or MDB_NOTFOUND!<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; if (insert_key) { <-------- tr=
ue<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; /* The key d=
oes not exist */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; DPRINTF((&qu=
ot;inserting key at index %i", mc->mc_ki[mc->mc_top]));<o:p></o:=
p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; if ((mc->=
mc_db->md_flags & MDB_DUPSORT) &&<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; LEAFSIZE(key, data) > env->me_nodemax) <-------- false si=
nce mc->mc_db->md_flags =3D 0<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; {<o:p></o:p>=
</p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; /* Too big for a node, insert in sub-DB. Set up an empty<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; * "old sub-page" for prep_subDB to expand to a full page=
.<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; */<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp_flags =3D P_LEAF|P_DIRTY;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp =3D env->me_pbuf;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_pad =3D data->mv_size; /* used if MDB_DUPFIXED */<o:p=
></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; fp->mp_lower =3D fp->mp_upper =3D (PAGEHDRSZ-PAGEBASE);<o:p>=
</o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; olddata.mv_size =3D PAGEHDRSZ;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; &=
nbsp; &nbs=
p; goto prep_subDB;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; &nbs=
p; } <------=
-- this was not executed, and the very long else contingency below is skipp=
ed!<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; } else {<o:p></o:p></p>
<p class=3D"MsoPlainText">Since mc->mc_db->md_flags =3D 0, the contin=
gency in the embedded if statement fails.<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">The segmentation fault occurs due to the call of =
IS_LEAF2 on the null pointer mc->mc_pg[0].<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; rdata =3D data;<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoPlainText">new_sub:<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; nflags =3D flags & NODE_ADD_F=
LAGS;<o:p></o:p></p>
<p class=3D"MsoPlainText"> &=
nbsp; nsize =3D IS_LEAF2(mc->mc_pg[m=
c->mc_top]) ? key->mv_size : mdb_leaf_size(env, key, rdata); <----=
---- SEGV<o:p></o:p></p>
<p class=3D"MsoPlainText"><o:p> </o:p></p>
<p class=3D"MsoNormal">Regards,<o:p></o:p></p>
<p class=3D"MsoNormal">Robins.<o:p></o:p></p>
</div>
</body>
</html>
--_000_MN2PR06MB55017A7261FA27380778753BAFEA0MN2PR06MB5501namp_--