syncrepl segfaulting entry_free() (ITS#3015)

[rhafer@suse.de]

Full_Name: Ralf Haferkamp
Version: 2.2.6
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (212.95.109.20)


While evaluation syncrepl, the slave slapd segfaulted. I was able to produce the
following backtrace:

#0  0x403cd7b9 in free () from /lib/libc.so.6
(gdb) bt
#0  0x403cd7b9 in free () from /lib/libc.so.6
#1  0x40059e0d in ber_memfree_x (p=Variable "p" is not available.
) at memory.c:153
#2  0x08073bf2 in ch_free (ptr=0x31646461) at ch_malloc.c:159
#3  0x08068b19 in entry_free (e=0x8154520) at entry.c:409
#4  0x08099d5b in do_syncrepl (ctx=0xbf5ff954, arg=0x814e450) at syncrepl.c:524
#5  0x400243e9 in ldap_int_thread_pool_wrapper (xpool=Variable "xpool" is not
available.
) at tpool.c:467
#6  0x4030e1c1 in pthread_start_thread () from /lib/libpthread.so.0
#7  0x404392ba in clone () from /lib/libc.so.6

The slave's syncrepl-config looks like this:
syncrepl rid=9
         provider=ldap://192.168.1.42
         type=refreshAndPersist
         searchbase="dc=suse,dc=de"
         updatedn="cn=syncrep,dc=suse,dc=de"
         bindmethod="simple"
         binddn="cn=Manager,dc=suse,dc=de"
         credentials="secret"

The segfault happend when I was hitting the master with a simple testcase using
the slapd-tester programm with two do_add-files each adding/deleting a simple
user entry. No clients were accessing the slave. The last few lines of the
logfile log like this (logging everything but ACL-processing)
====> bdb_cache_delete( 9 )
bdb_delete: deleted id=00000009 dn="uid=testadd1,ou=people,dc=suse,dc=de"
send_ldap_result: conn=4294967295 op=0 p=0
send_ldap_result: err=0 matched="" text=""
bdb_modify: cn=syncrepl9,dc=suse,dc=de
bdb_dn2entry("cn=syncrepl9,dc=suse,dc=de")
bdb_modify_internal: 0x00000006: cn=syncrepl9,dc=suse,dc=de
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
bdb_modify_internal: replace
=> key_change(DELETE,6)
bdb_idl_delete_key: 6 [0096defd]
<= key_change 0
=> key_change(DELETE,6)
bdb_idl_delete_key: 6 [65d02a87]
<= key_change 0
=> key_change(DELETE,6)
bdb_idl_delete_key: 6 [a0ccd171]
<= key_change 0
=> key_change(ADD,6)
bdb_idl_insert_key: 6 [0096defd]
<= key_change 0
=> key_change(ADD,6)
bdb_idl_insert_key: 6 [65d02a87]
<= key_change 0
=> key_change(ADD,6)
bdb_idl_insert_key: 6 [a0ccd171]
<= key_change 0
=> entry_encode(0x00000006): cn=syncrepl9,dc=suse,dc=de
bdb_modify: updated id=00000006 dn="cn=syncrepl9,dc=suse,dc=de"
send_ldap_result: conn=4294967295 op=0 p=0
send_ldap_result: err=0 matched="" text=""