ITS#8321 fix ambiguity in cursor_put fixup

After delete/add of a node, other nodes may no longer be
pointing at the data they intended. This can confuse subsequent
fixups.

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index b8c435583606d64314a1ab98d670d5a540d98fa5..b87099e487f48f9b33155fc2167b7095dfae270b 100644 (file)
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -6683,22 +6683,28 @@ new_sub:
        } else {
                /* There is room already in this leaf page. */
                rc = mdb_node_add(mc, mc->mc_ki[mc->mc_top], key, rdata, 0, nflags);
-               if (rc == 0 && insert_key) {
+               if (rc == 0) {
                        /* Adjust other cursors pointing to mp */
                        MDB_cursor *m2, *m3;
                        MDB_dbi dbi = mc->mc_dbi;
                        unsigned i = mc->mc_top;
                        MDB_page *mp = mc->mc_pg[i];
+                       int nkeys = NUMKEYS(mp);
 
                        for (m2 = mc->mc_txn->mt_cursors[dbi]; m2; m2=m2->mc_next) {
                                if (mc->mc_flags & C_SUB)
                                        m3 = &m2->mc_xcursor->mx_cursor;
                                else
                                        m3 = m2;
-                               if (m3 == mc || m3->mc_snum < mc->mc_snum) continue;
-                               if (m3->mc_pg[i] == mp && m3->mc_ki[i] >= mc->mc_ki[i]) {
+                               if (m3 == mc || m3->mc_snum < mc->mc_snum || m3->mc_pg[i] != mp) continue;
+                               if (m3->mc_ki[i] >= mc->mc_ki[i] && insert_key) {
                                        m3->mc_ki[i]++;
                                }
+                               if (m3->mc_xcursor && (m3->mc_xcursor->mx_cursor.mc_flags & C_INITIALIZED)) {
+                                       MDB_node *n2 = NODEPTR(mp, m3->mc_ki[i]);
+                                       if ((n2->mn_flags & (F_SUBDATA|F_DUPDATA)) == F_DUPDATA)
+                                               m3->mc_xcursor->mx_cursor.mc_pg[0] = NODEDATA(n2);
+                               }
                        }
                }
        }