Full_Name: Hallvard B Furuseth Version: LMDB_0.9.15 OS: URL: Submission from: (NULL) (81.191.45.5) Submitted by: hallvard

This code is wrong if the realloc in mdb_midl_shrink fails:

if (mdb_midl_shrink(&txn->mt_free_pgs)) env->me_free_pgs = txn->mt_free_pgs;

env->me_free_pgs is left pointing as an old, freed IDL. (Freed when mt_free_pgs was originally grown.) It should be:

mdb_midl_shrink(&txn->mt_free_pgs); env->me_free_pgs = txn->mt_free_pgs;

So mdb_midl_shrink() can return void.