ando@sys-net.it wrote:

To reproduce:

• set idlcache

• search one entry, so that the idl gets cached

• delete that entry, so that the idl gets cleared - but head/tail don't

• search another entry so that it gets cached - head/tail are corrupted

I've a fix for this about to come (affects 2.4.5 as well, sigh; not sure about re23).

Coverity shows this patch has introduced a NULL pointer dereference. @@ -364,6 +381,9 @@ ee = bdb->bi_idl_lru_tail; for ( i = 0; i < 10; i++, ee = eprev ) { eprev = ee->idl_lru_prev; + if ( eprev == ee ) { + eprev = NULL; + } if ( ee->idl_flags & CACHE_ENTRY_REFERENCED ) { ee->idl_flags ^= CACHE_ENTRY_REFERENCED; continue;

What's the purpose of this change, and should you be testing for a NULL now in the for loop conditions?