Full_Name: Hallvard B Furuseth
Version: mdb.master 057e0686303444d56f29a7bee0536e261fdf0b6a
OS: Linux x86_64
URL:
Submission from: (NULL) (193.69.163.163)
Submitted by: hallvard
mdb_put() not check for too big data. mdb_cursor_put() does not
check for too big key either. Nor can I see that ldmb.h documents
the limits, and there is no way to ask liblmdb what the limits are.
This can write an item of size (5000000000 & 0xffffffff) or crash:
MDB_val k1 = {3, "foo"}, x = {5000000000, NULL};
mdb_dbi_open(txn, NULL, MDB_CREATE, &dbi);
mdb_put(txn, dbi, &k1, &x, MDB_RESERVE);
Crash:
MDB_val k1 = {3, "foo"}, y = {5, "xyzzy"}, z = {10000, calloc(1,10000)};
mdb_dbi_open(txn, NULL, MDB_CREATE|MDB_DUPSORT, &dbi);
mdb_put(txn, dbi, &k1, &y, 0);
mdb_put(txn, dbi, &k1, &z, 0); /* segfault */
Crash:
MDB_val k2 = {8000, calloc(1, 8000)}, y = {5, "xyzzy"};
mdb_cursor_put(mc, &k2, &y, 0);
while this gives a proper EINVAL:
mdb_put(txn, dbi, &k2, &y, 0);