From: Howard Chu <hyc@symas.com>
Date: Mon, 21 Jul 2014 15:33:59 +0000 (-0700)
Subject: Fix mdb_cursor_count, reject uninit'd cursor
X-Git-Tag: OPENLDAP_REL_ENG_2_4_40~123^2
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=58e9c3add8c3fbe88f930531f237f070a652249b;p=openldap

Fix mdb_cursor_count, reject uninit'd cursor
---

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 4a21242239..9e4a068941 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -6989,6 +6989,9 @@ mdb_cursor_count(MDB_cursor *mc, size_t *countp)
 	if (mc->mc_txn->mt_flags & MDB_TXN_ERROR)
 		return MDB_BAD_TXN;
 
+	if (!(mc->mc_flags & C_INITIALIZED))
+		return EINVAL;
+
 	leaf = NODEPTR(mc->mc_pg[mc->mc_top], mc->mc_ki[mc->mc_top]);
 	if (!F_ISSET(leaf->mn_flags, F_DUPDATA)) {
 		*countp = 1;