Merge remote-tracking branch 'origin/mdb.RE/0.9'

libraries/liblmdb/CHANGES

@@ -9,6 +9,7 @@ LMDB 0.9.34 Engineering
 	ITS#10346 - fix mdb_env_copy2 with values > (2GB-16)
 	ITS#10355 - fix mplay build on musl
 	ITS#10396 - fix mdb_cursor_del0 with multiple DUPSORT cursors
+	ITS#10421 - mdb_load: check for malicious input
 
 LMDB 0.9.33 Release (2024/05/21)
 	ITS#9037 mdb_page_search: fix error code when DBI record is missing

libraries/liblmdb/mdb_load.c

@@ -208,6 +208,12 @@ badend:
 
 	c1 = buf->mv_data;
 	len = strlen((char *)c1);
+	if (!len) {
+		/* This can only happen with an intentionally invalid input
+		 * with a NUL byte after the leading SPACE
+		 */
+		goto badend;
+	}
 	l2 = len;
 
 	/* Is buffer too short? */