ITS#9564 lmdb: fix race condition freeing spilled pages at end of transaction

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 73892c16eaf8f2aaa02e443523d911c10571c4a3..a6b5375c0003e54c64d5d1a127d3785f6d787d47 100644 (file)
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -3078,6 +3078,7 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 
                txn->mt_numdbs = 0;
                txn->mt_flags = MDB_TXN_FINISHED;
+               mdb_midl_free(txn->mt_spill_pgs);
 
                if (!txn->mt_parent) {
                        mdb_midl_shrink(&txn->mt_free_pgs);
@@ -3099,7 +3100,6 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
                        mdb_midl_free(txn->mt_free_pgs);
                        free(txn->mt_u.dirty_list);
                }
-               mdb_midl_free(txn->mt_spill_pgs);
 
                mdb_midl_free(pghead);
        }