ITS#8335 LMDB: reject MDB_MULTIPLE put with 0 items

Also check for overflow of count and size.

diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index ba7ce9df9430bcac51e6483fd6d822e597be6be9..b665a62002cf6313a695234465aad3932e0c71b2 100644 (file)
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -8505,10 +8505,19 @@ _mdb_cursor_put(MDB_cursor *mc, MDB_val *key, MDB_val *data,
         * early failures.
         */
        if (flags & MDB_MULTIPLE) {
+               size_t tmp;
+               if (!data[1].mv_size)
+                       return EINVAL;
+
                dcount = data[1].mv_size;
                data[1].mv_size = 0;
                if (!F_ISSET(mc->mc_db->md_flags, MDB_DUPFIXED))
                        return MDB_INCOMPATIBLE;
+
+               /* check for overflow */
+               tmp = data[0].mv_size * dcount;
+               if (tmp/dcount != data[0].mv_size)
+                       return MDB_BAD_VALSIZE;
        }
 
        nospill = flags & MDB_NOSPILL;