Fix mdb_cursor_count, reject uninit'd cursor

10 years ago · 58e9c3add8
parent fcb0768e7d
commit 58e9c3add8
1 changed files with 3 additions and 0 deletions
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@ -6989,6 +6989,9 @@ mdb_cursor_count(MDB_cursor *mc, size_t *countp)
 	if (mc->mc_txn->mt_flags & MDB_TXN_ERROR)
 		return MDB_BAD_TXN;

+	if (!(mc->mc_flags & C_INITIALIZED))
+		return EINVAL;
+
 	leaf = NODEPTR(mc->mc_pg[mc->mc_top], mc->mc_ki[mc->mc_top]);
 	if (!F_ISSET(leaf->mn_flags, F_DUPDATA)) {
 		*countp = 1;