(ITS#8312) LMDB corruption, perhaps in freelist code

Full_Name: Martin Hedenfalk Version: N/A OS: centos 7 URL: http://bzero.se/patches/lmdb/ Submission from: (NULL) (62.181.224.2)

Please find linked a test program (replay.c) that consistently fails on my centos 7 system. It parses captured commands from a text file. I'm afraid they are quite large, I haven't been able to reduce them further.

The problem manifests itself in many different ways in my real system, sometimes I get MDB_CORRUPTED, sometimes MDB_BAD_TXN, sometimes errno EFBIG (and an unexpectedly large file) and sometimes a NULL pointer crash in mdb_freelist_save.

Given that valgrind complains about invalid read of size 8 in mdb_freelist_save/mdb_cursor_put, I'm *guessing* that the freelist code is put'ing an invalid MDB_val, leading to corruption.

Any help is greatly appreciated.

See the linked backtrace.txt for example runs. There are three captured replay logs (replay[123].txt) that show different failures.

This was tested with lmdb git master from github: commit 355f64ad07537a4f21dc6fe4cef66324316aa84b Author: Howard Chu hyc@openldap.org Date: Wed Nov 18 10:24:41 2015 +0000

ITS#8311 add comment

.martin