From 0e508f0d3b6dcae9f857b2ba9e73cc50c5662662 Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Thu, 28 Jan 2016 04:18:14 +0000
Subject: [PATCH] mdbx: backport - ITS#8363 Fix off-by-one in
 mdb_midl_shrink().

Change-Id: I92a2ed30703f6cd5e91c7f380f1954da4cbe896b
---
 CHANGES | 1 +
 midl.c  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index aae4ad10..73f6045e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,7 @@ LMDB 0.9.18 Release Engineering
 	Fix MDB_APPENDDUP vs. rewrite(single item) (ITS#8334)
 	n/a for mdbx - Fix mdb_copy of large files on Windows
 	Fix subcursor move after delete (ITS#8355)
+	Fix mdb_midl_shrink off-by-one (ITS#8363)
 	n/a for mdbx - Check for utf8_to_utf16 failures (ITS#7992)
 	Catch strdup failure in mdb_dbi_open
 	Build
diff --git a/midl.c b/midl.c
index ac41fd67..da46cc8d 100644
--- a/midl.c
+++ b/midl.c
@@ -120,7 +120,7 @@ static void mdb_midl_shrink( MDB_IDL *idp )
 {
 	MDB_IDL ids = *idp;
 	if (*(--ids) > MDB_IDL_UM_MAX &&
-		(ids = realloc(ids, (MDB_IDL_UM_MAX+1) * sizeof(MDB_ID))))
+		(ids = realloc(ids, (MDB_IDL_UM_MAX+2) * sizeof(MDB_ID))))
 	{
 		*ids++ = MDB_IDL_UM_MAX;
 		*idp = ids;