https://bugs.openldap.org/show_bug.cgi?id=9415

Howard Chu hyc@openldap.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |INVALID

--- Comment #1 from Howard Chu hyc@openldap.org --- (In reply to cwe from comment #0)

In my code I have a construct like this:

err = mdb_txn_commit(txn); if (err) { mdb_txn_abort(txn); }

I run codesonar on my code and include the lmdb source in the run. Codesonar reports a possible double free for the case where mdb_midl_append_list in mdb.c line 3586 returns ENOMEM. The code following line 3586 will free the txn and return ENOMEM. This will cause my code to call mdb_txn_abort, which will access the freed memory and call free again.

Please ask if more details are needed.

Please re-read the documentation of mdb_txn_commit(). Your code is misusing the API. Closing this ITS.