From 23219ed32a7e2aed22e01f8e9903f506d0f4e142 Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@symas.com>
Date: Thu, 26 Jul 2012 07:22:52 -0700
Subject: [PATCH] Fix 205bb17793e27be67098ccc80ee919165d7cb993

Ignore current cursor pos if it's out of bounds.
---
 libraries/libmdb/mdb.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/libraries/libmdb/mdb.c b/libraries/libmdb/mdb.c
index b5952da..85bacda 100644
--- a/libraries/libmdb/mdb.c
+++ b/libraries/libmdb/mdb.c
@@ -3858,20 +3858,22 @@ mdb_cursor_set(MDB_cursor *mc, MDB_val *key, MDB_val *data,
 					goto set1;
 				}
 				if (rc < 0) {
-					/* This is definitely the right page, skip search_page */
-					if (mp->mp_flags & P_LEAF2) {
-						nodekey.mv_data = LEAF2KEY(mp,
-							 mc->mc_ki[mc->mc_top], nodekey.mv_size);
-					} else {
-						leaf = NODEPTR(mp, mc->mc_ki[mc->mc_top]);
-						MDB_SET_KEY(leaf, &nodekey);
-					}
-					rc = mc->mc_dbx->md_cmp(key, &nodekey);
-					if (rc == 0) {
-						/* current node was the one we wanted */
-						if (exactp)
-							*exactp = 1;
-						goto set1;
+					if (mc->mc_ki[mc->mc_top] < NUMKEYS(mp)) {
+						/* This is definitely the right page, skip search_page */
+						if (mp->mp_flags & P_LEAF2) {
+							nodekey.mv_data = LEAF2KEY(mp,
+								 mc->mc_ki[mc->mc_top], nodekey.mv_size);
+						} else {
+							leaf = NODEPTR(mp, mc->mc_ki[mc->mc_top]);
+							MDB_SET_KEY(leaf, &nodekey);
+						}
+						rc = mc->mc_dbx->md_cmp(key, &nodekey);
+						if (rc == 0) {
+							/* current node was the one we wanted */
+							if (exactp)
+								*exactp = 1;
+							goto set1;
+						}
 					}
 					rc = 0;
 					goto set2;