(ITS#8200) Potential use of freed data after mdb_midl_shrink()

[h.b.furuseth@usit.uio.no]

Full_Name: Hallvard B Furuseth
Version: LMDB_0.9.15
OS: 
URL: 
Submission from: (NULL) (81.191.45.5)
Submitted by: hallvard


This code is wrong if the realloc in mdb_midl_shrink fails:

	if (mdb_midl_shrink(&txn->mt_free_pgs))
		env->me_free_pgs = txn->mt_free_pgs;

env->me_free_pgs is left pointing as an old, freed IDL.
(Freed when mt_free_pgs was originally grown.)
It should be:

	mdb_midl_shrink(&txn->mt_free_pgs);
	env->me_free_pgs = txn->mt_free_pgs;

So mdb_midl_shrink() can return void.