search on cn=config cores slapd (ITS#136)

[asparks@nss.harris.com]

Full_Name: Alan Sparks
Version: 1.2.1 stable
OS: HP/UX 10.20
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (151.114.2.83)


Originally observed using GQ client in browse mode.  Can be duplicated using
the
command:  ldapsearch -b "cn=config" -s base 'objectclass=*'

Slapd built with HP/UX 10.20, GCC 2.8.1 and libstdc 2.8.1.1.
Slapd dumps core immediately on receiving the above query, with the stack
trace:

#0  0xc00d3ca0 in regexec ()
#1  0x1fae4 in acl_get_applicable (be=0x2, op=0x40007b28, e=0x400051e8,
    attr=0x8e18 "entry", nmatch=10, matches=0x7b03b020) at acl.c:134
#2  0x1f68c in access_allowed (be=0x40006fe8, conn=0x4000a250, op=0x40005120,
    e=0x400051e8, attr=0x8e18 "entry", val=0x0, access=8) at acl.c:70
#3  0x1a014 in send_search_entry (be=0x40006fe8, conn=0x4000a250,
    op=0x40005120, e=0x400051e8, attrs=0x0, attrsonly=0) at result.c:196
#4  0x23bd4 in config_info (conn=0x4000a250, op=0x40005120) at configinfo.c:66
#5  0x13fb0 in do_search (conn=0x4000a250, op=0x40005120) at search.c:152
#6  0x134b0 in connection_operation (arg_v=0x0) at connection.c:86
#7  0x353d4 in ldap_pvt_thread_create (thread=0x0, detach=0, start_routine=0,
    arg=0x7b03b020) at thr_stub.c:40
#8  0x13970 in connection_activity (conn=0x4000a250) at connection.c:207
#9  0x12e84 in slapd_daemon (port=0x0) at daemon.c:362
#10 0x353d4 in ldap_pvt_thread_create (thread=0x0, detach=0, start_routine=0,
    arg=0x7b03b020) at thr_stub.c:40
#11 0x11748 in main (argc=3, argv=0x7b03a2dc) at main.c:202

Logging with loglevel 2+4+256 shows:
Apr 21 21:20:38 mercury slapd[17575]: conn=0 op=1 SRCH base="CN=CONFIG" scope=0
filter="(objectclass=*)"
Apr 21 21:20:38 mercury slapd[17575]: => send_search_entry (CN=CONFIG)
Apr 21 21:20:38 mercury slapd[17575]: => acl_get: edn
Apr 21 21:20:38 mercury slapd[17575]: => acl_get: [1] check attr entry
Apr 21 21:20:38 mercury slapd[17575]: => dnpat: [2] .* nsub: 0