(ITS#5541) slapd segfaults with specific search on string bdb and hdb backend

[pwadas@jewish.org.pl]

Full_Name: Piotr Wadas
Version: 2.4.7 upto 2.4.9
OS: debian 2.6.18+ kernel
URL: 
Submission from: (NULL) (195.95.182.4)


The issue is discussed at
http://www.openldap.org/lists/openldap-software/200805/msg00136.html

List message contains debug information, steps to reproduce,
backtrace logs etc.
Issue appears since 2.4.7 in 2.4 series.


gdb bt quick ref:

#0  0xb7b4842c in free () from /usr/lib/i486-linux-gnu/i686/cmov/libc.so.6
#1  0xb7e901aa in ber_memfree_x (p=0x0, ctx=0x0) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:152
#2  0xb7e9019c in ber_memfree_x (p=0x0, ctx=0x0) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:159
#3  0xb7e90235 in ber_bvarray_free_x (a=0xa96e3354, ctx=0x8279658) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:731
#4  0xb73028e5 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa96e325c,
ids=0xa9062008, tmp=0xa8ee2008, stack=0xa90e2008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:803
#5  0xb7303064 in list_candidates (op=0x82792e0, locker=34, flist=0xa96e31ec,
ftype=160, ids=0xa8fe2008, tmp=0xa8ee2008, save=0xa9062008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:581
#6  0xb73017c7 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa96e32bc,
ids=0xa8fe2008, tmp=0xa8ee2008, stack=0xa9062008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:198
#7  0xb7303064 in list_candidates (op=0x82792e0, locker=34, flist=0xa9be2ec8,
ftype=161, ids=0xa8f62008, tmp=0xa8ee2008, save=0xa8fe2008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:581
#8  0xb73015ca in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa9be2ebc,
ids=0xa8f62008, tmp=0xa8ee2008, stack=0xa8fe2008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:204
#9  0xb7303064 in list_candidates (op=0x82792e0, locker=34, flist=0xa9be2eb0,
ftype=160, ids=0xa9b22e1c, tmp=0xa8ee2008, save=0xa8f62008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:581
#10 0xb73017c7 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa9be2ed4,
ids=0xa9b22e1c, tmp=0xa8ee2008, stack=0xa8f62008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:198
#11 0xb72fc858 in bdb_search (op=0x82792e0, rs=0xa9be4168) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/search.c:1109
#12 0x080d76f1 in overlay_op_walk (op=0x82792e0, rs=0xa9be4168, which=op_search,
oi=0x81f63d8, on=0x81f64d8) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/backover.c:646
#13 0x080d7c5d in over_op_func (op=0x82792e0, rs=0xa9be4168, which=op_search) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/backover.c:698
#14 0x08077fd3 in fe_op_search (op=0x82792e0, rs=0xa9be4168) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/search.c:366
#15 0x080787fc in do_search (op=0x82792e0, rs=0xa9be4168) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/search.c:217
#16 0x08075a9f in connection_operation (ctx=0xa9be4248, arg_v=0x82792e0) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/connection.c:1084
#17 0x08076196 in connection_read_thread (ctx=0xa9be4248, argv=0x10) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/connection.c:1211
#18 0xb7ea1d64 in ldap_int_thread_pool_wrapper (xpool=0x81b09b8) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/libldap_r/tpool.c:663
#19 0xb7c2c4fb in start_thread () from
/usr/lib/i486-linux-gnu/i686/cmov/libpthread.so.0
#20 0xb7bafe8e in clone () from /usr/lib/i486-linux-gnu/i686/cmov/libc.so.6