File db-4.5.20-rep.patch of Package libdb-4_5

Index: rep/rep_method.c
===================================================================
--- rep/rep_method.c.orig
+++ rep/rep_method.c
@@ -526,10 +526,12 @@ __rep_start(dbenv, dbt, flags)
 		 * will allow the client to either perform recovery or
 		 * simply join in.
 		 */
-		if (announce)
+		if (announce) {
+			if ((ret = __dbt_usercopy(dbenv, dbt)) != 0)
+				goto err;
 			(void)__rep_send_message(dbenv,
 			    DB_EID_BROADCAST, REP_NEWCLIENT, NULL, dbt, 0, 0);
-		else
+		} else
 			(void)__rep_send_message(dbenv,
 			    DB_EID_BROADCAST, REP_ALIVE_REQ, NULL, NULL, 0, 0);
 	}
@@ -553,6 +555,7 @@ err:		REP_SYSTEM_UNLOCK(dbenv);
 	}
 	if (pending_event != DB_EVENT_NO_SUCH_EVENT)
 		DB_EVENT(dbenv, pending_event, NULL);
+	__dbt_userfree(dbenv, dbt, NULL, NULL);
 	return (ret);
 }
 
Index: rep/rep_record.c
===================================================================
--- rep/rep_record.c.orig
+++ rep/rep_record.c
@@ -163,6 +163,14 @@ __rep_process_message(dbenv, control, re
 		return (EINVAL);
 	}
 
+	if ((ret = __dbt_usercopy(dbenv, control)) != 0 ||
+ 	    (ret = __dbt_usercopy(dbenv, rec)) != 0) {
+ 		__dbt_userfree(dbenv, control, rec, NULL);
+ 		__db_errx(dbenv,
+ 	"DB_ENV->rep_process_message: error retrieving DBT contents");
+ 		return ret;
+ 	}
+
 	ret = 0;
 	db_rep = dbenv->rep_handle;
 	rep = db_rep->region;
@@ -621,6 +629,7 @@ out:
 			*ret_lsnp = rp->lsn;
 		ret = DB_REP_NOTPERM;
 	}
+	__dbt_userfree(dbenv, control, rec, NULL);
 	return (ret);
 }