https://bugs.openldap.org/show_bug.cgi?id=10522
Issue ID: 10522 Summary: Heap-buffer-overflow in mdb_cursor_last Product: LMDB Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: liblmdb Assignee: bugs@openldap.org Reporter: renault.cle@gmail.com Target Milestone: ---
Created attachment 1155 --> https://bugs.openldap.org/attachment.cgi?id=1155&action=edit Reproducer for a heap-buffer-overflow
Hello,
I was fuzzing a bit LMDB on my personnal time and found memory issue. I attached the reproducer. It is only reproducible when compiled with ASan/UBSan (-fsanitize=address,undefined) on macOS and you can get a segfault on Linux (6.1.0-44-amd64, Debian 6.1.164-1).
The issue appears in the mdb_cursor_last function line 8257 on commit 7bcb4d05da7cf1546133baf51178e5e1b53cdd53 from branch mdb.RE/1.0.
Thank you for your help, Have a nice day
PS: I cannot specify the right version in the version list. PS2: I get a 401 Authorization Required when I try to connect through GitHub from Arc Browser.