ITS#8722 fix FIRST_DUP/LAST_DUP cursor bounds check

LMDB · Feb 11, 2018 · 98b2910 · 98b2910
1 parent 2642634
commit 98b2910
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
@@ -6426,6 +6426,11 @@ mdb_cursor_get(MDB_cursor *mc, MDB_val *key, MDB_val *data,
 			rc = MDB_INCOMPATIBLE;
 			break;
 		}
+		if (mc->mc_ki[mc->mc_top] >= NUMKEYS(mc->mc_pg[mc->mc_top])) {
+			mc->mc_ki[mc->mc_top] = NUMKEYS(mc->mc_pg[mc->mc_top]);
+			rc = MDB_NOTFOUND;
+			break;
+		}
 		{
 			MDB_node *leaf = NODEPTR(mc->mc_pg[mc->mc_top], mc->mc_ki[mc->mc_top]);
 			if (!F_ISSET(leaf->mn_flags, F_DUPDATA)) {
@@ -7080,6 +7085,7 @@ mdb_cursor_del(MDB_cursor *mc, unsigned int flags)
 						if (!(m2->mc_flags & C_INITIALIZED)) continue;
 						if (m2->mc_pg[mc->mc_top] == mp) {
 							MDB_node *n2 = leaf;
+							if (m2->mc_ki[mc->mc_top] >= NUMKEYS(mp)) continue;
 							if (m2->mc_ki[mc->mc_top] != mc->mc_ki[mc->mc_top]) {
 								n2 = NODEPTR(mp, m2->mc_ki[mc->mc_top]);
 								if (n2->mn_flags & F_SUBDATA) continue;