From: Howard Chu <hyc@symas.com>
Date: Mon, 3 Oct 2011 19:40:53 +0000 (-0700)
Subject: Fix freelist bug on page split
X-Git-Tag: OPENLDAP_REL_ENG_2_4_27~148^2~4
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=ea0d07ffa324cd834b87dd29053961366172330b;p=openldap

Fix freelist bug on page split

NULL out env->pghead before writing it, so that its pages can't be used
to satisfy the write.
---

diff --git a/libraries/libmdb/mdb.c b/libraries/libmdb/mdb.c
index 1995ea82d5..3a82192ce5 100644
--- a/libraries/libmdb/mdb.c
+++ b/libraries/libmdb/mdb.c
@@ -1128,7 +1128,7 @@ mdb_page_alloc(MDB_cursor *mc, int num)
 	if (pgno == P_INVALID) {
 		/* DB size is maxed out */
 		if (txn->mt_next_pgno + num >= txn->mt_env->me_maxpg) {
-			DPRINTF("DB size maxed out");
+			DPUTS("DB size maxed out");
 			return NULL;
 		}
 	}
@@ -1764,13 +1764,13 @@ mdb_txn_commit(MDB_txn *txn)
 		MDB_oldpages *mop;
 
 		mop = env->me_pghead;
+		env->me_pghead = NULL;
 		key.mv_size = sizeof(pgno_t);
 		key.mv_data = &mop->mo_txnid;
 		data.mv_size = MDB_IDL_SIZEOF(mop->mo_pages);
 		data.mv_data = mop->mo_pages;
 		mdb_cursor_put(&mc, &key, &data, 0);
-		free(env->me_pghead);
-		env->me_pghead = NULL;
+		free(mop);
 	}
 
 	/* Update DB root pointers. Their pages have already been
@@ -3202,6 +3202,7 @@ mdb_page_search(MDB_cursor *mc, MDB_val *key, int modify)
 		}
 	}
 
+	assert(root > 1);
 	if ((rc = mdb_page_get(mc->mc_txn, root, &mc->mc_pg[0])))
 		return rc;