ITS#8363 Fix off-by-one in mdb_midl_shrink

hyc · hyc · commit c322c4c76cc3 · 2016-01-28T04:21:56.000Z
diff --git a/libraries/liblmdb/midl.c b/libraries/liblmdb/midl.c
@@ -120,7 +120,7 @@ void mdb_midl_shrink( MDB_IDL *idp )
 {
 	MDB_IDL ids = *idp;
 	if (*(--ids) > MDB_IDL_UM_MAX &&
-		(ids = realloc(ids, (MDB_IDL_UM_MAX+1) * sizeof(MDB_ID))))
+		(ids = realloc(ids, (MDB_IDL_UM_MAX+2) * sizeof(MDB_ID))))
 	{
 		*ids++ = MDB_IDL_UM_MAX;
 		*idp = ids;

Original file line number	Diff line number	Diff line change
`@@ -120,7 +120,7 @@ void mdb_midl_shrink( MDB_IDL *idp )`
`120`	`120`	`{`
`121`	`121`	`MDB_IDL ids = *idp;`
`122`	`122`	`if (*(--ids) > MDB_IDL_UM_MAX &&`
`123`		`- (ids = realloc(ids, (MDB_IDL_UM_MAX+1) * sizeof(MDB_ID))))`
	`123`	`+ (ids = realloc(ids, (MDB_IDL_UM_MAX+2) * sizeof(MDB_ID))))`
`124`	`124`	`{`
`125`	`125`	`*ids++ = MDB_IDL_UM_MAX;`
`126`	`126`	`*idp = ids;`