Re: (ITS#9097) lmdb: premature free of env->me_txn0

christopher@gmerlin.de wrote:

Full_Name: Christopher Zimmermann Version: lmdb 0.9.24 OS: OpenBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (85.212.180.240)

Hi,

I can reliably hit a Bus error on OpenBSD. This is triggered by OpenBSDs malloc/free junking [1] and a use-after-free bug in lmdb.

Steps to reproduce:

• begin a read/write transaction (getting env->me_txn0)
• fill the environment -> returns MDB_MAP_FULL -> sets txn->mt_flags |= MDB_TXN_ERROR; (This is also env->me_txn0 !) -> calls mdb_txn_abort

...

• abort the transaction (again) with mdb_abort()

This is a bug in your code, you can't call txn_abort twice. This is already documented. Closing this ITS.