Fix a sizeof error in __bt_put.
authorPeter Avalos <pavalos@theshell.com>
Sun, 8 Feb 2009 16:38:00 +0000 (11:38 -0500)
committerPeter Avalos <pavalos@theshell.com>
Tue, 7 Apr 2009 07:09:11 +0000 (21:09 -1000)
memmove() was used on pointers to size_ts, but only
sizeof(u_int32_t) bytes where copied.

Obtained-from: FreeBSD

lib/libc/db/btree/bt_put.c

index 6aa92fd..97e7117 100644 (file)
@@ -67,7 +67,7 @@ __bt_put(const DB *dbp, DBT *key, const DBT *data, u_int flags)
        PAGE *h;
        indx_t idx, nxtindex;
        pgno_t pg;
-       u_int32_t nbytes;
+       u_int32_t nbytes, tmp;
        int dflags, exact, status;
        char *dest, db[NOVFLSIZE], kb[NOVFLSIZE];
 
@@ -120,8 +120,9 @@ storekey:           if (__ovfl_put(t, key, &pg) == RET_ERROR)
                        tkey.data = kb;
                        tkey.size = NOVFLSIZE;
                        memmove(kb, &pg, sizeof(pgno_t));
+                       tmp = key->size;
                        memmove(kb + sizeof(pgno_t),
-                           &key->size, sizeof(u_int32_t));
+                           &tmp, sizeof(u_int32_t));
                        dflags |= P_BIGKEY;
                        key = &tkey;
                }
@@ -131,8 +132,9 @@ storekey:           if (__ovfl_put(t, key, &pg) == RET_ERROR)
                        tdata.data = db;
                        tdata.size = NOVFLSIZE;
                        memmove(db, &pg, sizeof(pgno_t));
+                       tmp = data->size;
                        memmove(db + sizeof(pgno_t),
-                           &data->size, sizeof(u_int32_t));
+                           &tmp, sizeof(u_int32_t));
                        dflags |= P_BIGDATA;
                        data = &tdata;
                }