Segmentaion fault with ldap backend (ITS#3021)

[johnlee@qnap.com.tw]

Full_Name: John C.Y. Lee
Version: 2.1.25
OS: RedHat 7.3
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (61.218.72.138)


While using ldap backend, I found that the front slapd will get
segmentation fault on severeal occasion.

The front ldap server: (refer to back ldap server, WITH "suffix massage"
suffixmassage "dc=my-domain,dc=com" "dc=JohnLee-Fedora")

[root@JohnLee-rh73 slapd]# ./slapd -4 -d 256
bdb_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December  3, 2003)
slapd starting
conn=0 fd=9 ACCEPT from IP=127.0.0.1:32778 (IP=0.0.0.0:389)
conn=0 op=0 BIND dn="" method=128
deferring operation
conn=0 op=0 RESULT tag=97 err=0 text=
conn=0 op=1 SRCH base="dc=my-domain,dc=com" scope=2 filter="(objectClass=*)"
request 1 done
Segmentation fault
[root@JohnLee-rh73 slapd]#

The client reads:

...

# Protocols, my-domain.com
dn: ou=Protocols,dc=my-domain,dc=com
ou: Protocols
objectClass: top
objectClass: organizationalUnit

# Networks, my-domain.com
dn: ou=Networks,dc=my-domain,dc=com
ou: Networks
objectClass: top
objectClass: organizationalUnit

# root, Group, my-domain.com
dn: cn=root,ou=Group,dc=my-domain,dc=com
objectClass: posixGroup
objectClass: top
cn: root
ldap_result: Can't contact LDAP server (81)

If I search the real back ldap server, the result is:

...

# root, Group, JohnLee-Fedora
dn: cn=root,ou=Group,dc=JohnLee-Fedora
objectClass: posixGroup
objectClass: top
cn: root
gidNumber: 0

# bin, Group, JohnLee-Fedora
dn: cn=bin,ou=Group,dc=JohnLee-Fedora
objectClass: posixGroup
objectClass: top
cn: bin
gidNumber: 1
memberUid: daemon
memberUid: root

...

If I run the front ldap server WITHOUT massage, everything seems right.

...

# Networks, JohnLee-Fedora
dn: ou=Networks,dc=JohnLee-Fedora
ou: Networks
objectClass: top
objectClass: organizationalUnit

# root, Group, JohnLee-Fedora
dn: cn=root,ou=Group,dc=JohnLee-Fedora
objectClass: posixGroup
objectClass: top
cn: root

# bin, Group, JohnLee-Fedora
dn: cn=bin,ou=Group,dc=JohnLee-Fedora
objectClass: posixGroup
objectClass: top
cn: bin

...

So I tried to back trace it, and find the following:

Program received signal SIGSEGV, Segmentation fault.
0x4015d0c7 in pthread_mutex_lock () from /lib/i686/libpthread.so.0
(gdb) bt
#0  0x4015d0c7 in pthread_mutex_lock () from /lib/i686/libpthread.so.0
#1  0x4207ac18 in free () from /lib/i686/libc.so.6
#2  0x080bbced in ber_bvarray_free (a=0x81c6e58) at memory.c:658
#3  0x08089b9a in ldap_send_entry (be=0x8192098, op=0x81c6458, lc=0x81c6868,
    e=0x81c6ba0, attrs=0x0, attrsonly=0) at search.c:636
#4  0x08089529 in ldap_back_search (be=0x8192098, conn=0x40183c68,
    op=0x81c6458, base=0x40dcd87c, nbase=0x40dcd884, scope=2, deref=0,
    slimit=0, tlimit=0, filter=0x81c6568, filterstr=0x40dcd86c, attrs=0x0,
    attrsonly=0) at search.c:292
#5  0x0805339e in do_search (conn=0x40183c68, op=0x81c6458) at search.c:401
#6  0x08051936 in connection_operation (ctx=0x81c6300, arg_v=0x81c6458)
    at connection.c:943
#7  0x0809ebe9 in ldap_int_thread_pool_wrapper (xpool=0x8184d60) at tpool.c:432
#8  0x4015bfef in pthread_start_thread () from /lib/i686/libpthread.so.0
#9  0x4015c0df in pthread_start_thread_event () from /lib/i686/libpthread.so.0

Seems like something wrong in "ldap_send_entry".

Then I thought it might because some attributes are undefined in the front
ldap server, so I tried to include the same schema on both server.  (just
like ITS#1366)

Now it runs a little further, but still dies at last.

front server:

[root@JohnLee-rh73 slapd]# ./slapd -4 -d 256
bdb_initialize: Sleepycat Software: Berkeley DB 4.2.52: (December  3, 2003)
slapd starting
conn=0 fd=9 ACCEPT from IP=127.0.0.1:32789 (IP=0.0.0.0:389)
conn=0 op=0 BIND dn="" method=128
deferring operation
conn=0 op=0 RESULT tag=97 err=0 text=
conn=0 op=1 SRCH base="dc=my-domain,dc=com" scope=2 filter="(objectClass=*)"
request 1 done
request 2 done
Segmentation fault

client:

...

# tester, People, my-domain.com
dn: uid=tester,ou=People,dc=my-domain,dc=com
uid: tester
cn: a test account
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 100
homeDirectory: /home/tester
gecos: a test account
shadowLastChange: 12446
ldap_result: Can't contact LDAP server (81)

the real back ldap server result:

...

# tester, People, JohnLee-Fedora
dn: uid=tester,ou=People,dc=JohnLee-Fedora
uid: tester
cn: a test account
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 100
homeDirectory: /home/tester
gecos: a test account
shadowLastChange: 12446

# search result
search: 2
result: 0 Success

# numResponses: 126
# numEntries: 125

I'll try to gather more information about this. Thanks for your
effort to develop such a nice software.