Segfault with current on a search (ITS#451)

[ian@nmsu.edu]

Full_Name: Ian Logan
Version: current
OS: FreeBSD 3.4
URL: 
Submission from: (NULL) (128.123.100.20)


Hello,
I've been playing with current just for fun, out production stuff is using
1.2.9.
This is all being done on a FreeBSD 3.4 machine.
Basicaly we have a simple phonebook application.  When we search it with
Netscape slapd 
always core dumps at the same place (more information included below).  I've
tried 
just about every variation of things in the config file I can think of, it
doesn't make 
a difference.  If I turn off index's then the crash happens instantly, while
with
index's (of the cn,sn,givenname fields) on it takes a few minutes of searching
before
the crash.

I dont really have time this week to dig through the code to figure out whats
going
on, so I'm posting this on the off chance that someone who knows the code better
than I 
will know whats going on.  Otherwise I'll try to figure things out starting next
week. 
I've never worked on the OpenLDAP source code before, any pointers would be
greatly 
appreciated.

This was with todays source code, allthough its been this way for at least the
last
few days.

Here is the log output at level 256 (I'd be happy to do any experiments if 
more or different data would be usefull)
slapd starting
conn=0 op=0 BIND dn="" method=128
conn=0 op=0 RESULT tag=97 err=0 text=
conn=0 op=1 SRCH base="dc=NMSU,dc=Edu" scope=2 filter="(|(cn=IAN*
LOGAN*)(mail=I
AN* LOGAN*)(sn=IAN* LOGAN*))"
Segmentation fault (core dumped)

Slapd always seg faults at the same line of code in the backend.
gdb slapd slapd.core
Program terminated with signal 11, Segmentation fault.
#0  0x80697d7 in substring_comp_candidates (be=0x80c9400,
    type=0x80d10c0 "mail", bv=0x80d1190, prepost=0) at filterindex.c:361
361                             buf[i] = p[i];

And finally, here is the relevant parts of the config I'm using.  I've tried
this with and without schema checking, with the version 1.2.x and 2.x schema
files, etc.
include         /usr/local/ldap2/etc/openldap/slapd.at.conf
include         /usr/local/ldap2/etc/openldap/slapd.oc.conf
database        ldbm
suffix          "dc=NMSU, dc=Edu"
schemacheck off

And lastly, here is the the ldif file needed to produce the database (its
short)
dn: dc=NMSU,dc=Edu
objectclass: top
objectclass: organization
o: NMSU
description: New Mexico State University
dn: ou=People, dc=NMSU, dc=Edu
objectclass: top
objectclass: organizationalUnit
ou: People
dn: uid=ian,ou=People,dc=NMSU,dc=Edu
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
ou: People
cn: ian logan
givenname: ian
sn: logan
uid: ian
mail: ian@nmsu.edu

If there is any information that would be helpful that I failed to include,
please
let me know.  
Thanks for your time!
Ian