(ITS#3404) sockber stack SEGVs

[richton@nbcs.rutgers.edu]

Full_Name: Aaron Richton
Version: 2.2.18
OS: Solaris 9
URL: 
Submission from: (NULL) (128.6.30.195)


Opening per Jong-Hyuk's ITS#3296 Followup 17:
questionable behavior of the sockber stack upon error, possible relations to
ITS#3172, ITS#3139, ITS#3296.

Here is one SEGV backtrace to get this started (ITS#3296 Followup #16).
Additional reproductions and/or related debug logs available upon request.

 Thread 3 (process 151676    ):
 #0  0xfee9d608 in _poll () from /usr/lib/libc.so.1
 #1  0xfee51e78 in _select () from /usr/lib/libc.so.1
 #2  0xfedce6b4 in select () from /usr/lib/libthread.so.1
 #3  0x00070fe0 in slapd_daemon_task (ptr=0x0) at daemon.c:1422

 Thread 2 (process 86140    ):
 #0  0xfee9f334 in _lwp_wait () from /usr/lib/libc.so.1
 #1  0xfedcd6bc in lwp_wait () from /usr/lib/libthread.so.1
 #2  0xfedc90f0 in _thrp_join () from /usr/lib/libthread.so.1
 #3  0x001837a0 in ldap_pvt_thread_join (thread=2, thread_return=0x0)
     at thr_posix.c:151
 #4  0x00072b14 in slapd_daemon () at daemon.c:2037
 #5  0x00061184 in main (argc=6, argv=0xffbffce4) at main.c:713

 Thread 1 (process 217212    ):
 #0  0xff2507e0 in SSL_write () from /usr/local/lib/libssl.so.0.9.7
 #1  0x001ba5cc in sb_tls_write (sbiod=0x3e3920, buf=0xeb5af0, len=782)
     at tls.c:594
 #2  0x001cd0f4 in sb_debug_write (sbiod=0x3e3880, buf=0xeb5af0, len=782)
     at sockbuf.c:839
 #3  0x001cbc74 in ber_int_sb_write (sb=0x3d8f30, buf=0xeb5af0, len=782)
 #4  0x001c58dc in ber_flush (sb=0x3d8f30, ber=0xda33f630, freeit=0) at
io.c:243
 #5  0x0008b1f4 in send_ldap_ber (conn=0x3e5fc8, ber=0xda33f630) at
result.c:176
 #6  0x0008f0f4 in slap_send_search_entry (op=0x3f9f20, rs=0xda3ffd58)
     at result.c:1304
 #7  0x00112394 in hdb_do_search () at tools.c:288
 #8  0x0010e96c in hdb_search () at tools.c:288
 #9  0x00079ed8 in do_search (op=0x3f9f20, rs=0xda3ffd58) at search.c:412
 #10 0x0007636c in connection_operation (ctx=0xda3ffe14, arg_v=0x3f9f20)
     at connection.c:1079
 #11 0x00182470 in ldap_int_thread_pool_wrapper (xpool=0x33d758) at
tpool.c:467