From eaeeecc3b28a814d6793b57102d9e03ff9a8cef7 Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Mon, 12 Aug 2013 12:43:42 -0700 Subject: [PATCH] Fix uninit'd mem ref in mdb_page_split Don't compare cursors beyond their depth. (detected by valgrind) --- libraries/liblmdb/mdb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c index ceda385..6460173 100644 --- a/libraries/liblmdb/mdb.c +++ b/libraries/liblmdb/mdb.c @@ -7653,7 +7653,7 @@ done: m3->mc_snum++; m3->mc_top++; } - if (m3->mc_pg[mc->mc_top] == mp) { + if (m3->mc_top >= mc->mc_top && m3->mc_pg[mc->mc_top] == mp) { if (m3->mc_ki[mc->mc_top] >= newindx && !(nflags & MDB_SPLIT_REPLACE)) m3->mc_ki[mc->mc_top]++; if (m3->mc_ki[mc->mc_top] >= fixup) { @@ -7661,7 +7661,7 @@ done: m3->mc_ki[mc->mc_top] -= fixup; m3->mc_ki[ptop] = mn.mc_ki[ptop]; } - } else if (!did_split && m3->mc_pg[ptop] == mc->mc_pg[ptop] && + } else if (!did_split && m3->mc_top >= ptop && m3->mc_pg[ptop] == mc->mc_pg[ptop] && m3->mc_ki[ptop] >= mc->mc_ki[ptop]) { m3->mc_ki[ptop]++; }