If the record is at the end of the database, pretending it has length 1

might take us out-of-bounds.  Only pretend to be length 1 for the malloc.

diff --git a/lib/tdb/common/io.c b/lib/tdb/common/io.c
index 661f76148927bd7fcbb5c664d882ac2d2f28ae27..a0b3a3f24a4812c5e79fa806022e5bcd95f19ba8 100644 (file)
--- a/lib/tdb/common/io.c
+++ b/lib/tdb/common/io.c
@@ -383,11 +383,8 @@ unsigned char *tdb_alloc_read(struct tdb_context *tdb, tdb_off_t offset, tdb_len
        unsigned char *buf;
 
        /* some systems don't like zero length malloc */
-       if (len == 0) {
-               len = 1;
-       }
 
-       if (!(buf = (unsigned char *)malloc(len))) {
+       if (!(buf = (unsigned char *)malloc(len ? len : 1))) {
                /* Ensure ecode is set for log fn. */
                tdb->ecode = TDB_ERR_OOM;
                TDB_LOG((tdb, TDB_DEBUG_ERROR,"tdb_alloc_read malloc failed len=%d (%s)\n",