Description: Segfault fix on memo zero length multiple page
 .
 While converting memo field to string, stop processing on zero length
 multiple page.
Author: lovelytwo <>
Reviewed-by: Jean-Michel Vourgère <jmv_deb@nirgal.com>
Last-Update: 2014-05-02
Applied-Upstream: commit:a89baeacf5976daf196e6f902fa84ca176d399db

Index: mdbtools/src/libmdb/data.c
===================================================================
--- mdbtools.orig/src/libmdb/data.c
+++ mdbtools/src/libmdb/data.c
@@ -732,9 +732,13 @@ static char *mdb_memo_to_string(MdbHandl
 			printf("row num %d start %d len %d\n",
 				pg_row & 0xff, row_start, len);
 #endif
-			if (tmpoff + len - 4 > memo_len) {
+			if (tmpoff + len - 4 > memo_len)
 				break;
-			}
+
+			/* Stop processing on zero length multiple page memo fields */
+			if (!len)
+				break;
+
 			memcpy(tmp + tmpoff, buf + row_start + 4, len - 4);
 			tmpoff += len - 4;
 		} while (( pg_row = mdb_get_int32(buf, row_start) ));
