Fix mdb_cursor_count, reject uninit'd cursor

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 4a21242239d4795b38cb60fdf0acc71a19d996bd..9e4a0689410c071d83bfc9d8866866f182a10d2f 100644 (file)
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -6989,6 +6989,9 @@ mdb_cursor_count(MDB_cursor *mc, size_t *countp)
        if (mc->mc_txn->mt_flags & MDB_TXN_ERROR)
                return MDB_BAD_TXN;
 
+       if (!(mc->mc_flags & C_INITIALIZED))
+               return EINVAL;
+
        leaf = NODEPTR(mc->mc_pg[mc->mc_top], mc->mc_ki[mc->mc_top]);
        if (!F_ISSET(leaf->mn_flags, F_DUPDATA)) {
                *countp = 1;