Odd issue with back-meta

["Pierangelo Masarati" <ando@sys-net.it>]

In the ldap_result() loop in meta_back_search() there's an assert() if an
unexpected message type is returned.  I'm getting a core under heavy load;
what's strange is that apparently an "impossible" message, with 99
(LDAP_REQ_SEARCH) type, is returned.  I'm currently testing with HEAD, and
saw this issue twice.  The backtrace shows:

gdb ../servers/slapd/slapd core.14173
bt
#0  0x40491b71 in kill () from /lib/i686/libc.so.6
#1  0x40229cf1 in pthread_kill () from /lib/i686/libpthread.so.0
#2  0x4022a00b in raise () from /lib/i686/libpthread.so.0
#3  0x40491904 in raise () from /lib/i686/libc.so.6
#4  0x40492e8c in abort () from /lib/i686/libc.so.6
#5  0x4048ae84 in __assert_fail () from /lib/i686/libc.so.6
#6  0x080f77be in meta_back_search (op=0x841c8e8, rs=0x429eec9c) at
search.c:724
#7  0x08082f64 in fe_op_search (op=0x841c8e8, rs=0x429eec9c) at search.c:355
#8  0x0808274f in do_search (op=0x841c8e8, rs=0x429eec9c) at search.c:217
#9  0x080807b0 in connection_operation (ctx=0x429eed5c, arg_v=0x841c8e8)
at connection.c:1307
#10 0x08080af1 in connection_read_thread (ctx=0x429eed5c, argv=0x25) at
connection.c:1434
#11 0x08184d74 in ldap_int_thread_pool_wrapper (xpool=0x830da18) at
tpool.c:615
#12 0x40226f60 in pthread_start_thread () from /lib/i686/libpthread.so.0
#13 0x40544327 in clone () from /lib/i686/libc.so.6

A bt full shows:
(gdb) bt full
#0  0x40491b71 in kill () from /lib/i686/libc.so.6
No symbol table info available.
#1  0x40229cf1 in pthread_kill () from /lib/i686/libpthread.so.0
No symbol table info available.
#2  0x4022a00b in raise () from /lib/i686/libpthread.so.0
No symbol table info available.
#3  0x40491904 in raise () from /lib/i686/libc.so.6
No symbol table info available.
#4  0x40492e8c in abort () from /lib/i686/libc.so.6
No symbol table info available.
#5  0x4048ae84 in __assert_fail () from /lib/i686/libc.so.6
No symbol table info available.
#6  0x080f77be in meta_back_search (op=0x841c8e8, rs=0x429eec9c) at
search.c:724
        sr_ref = 0x0
        cnt = 0
        mi = (metainfo_t *) 0x8333af8
        mc = (metaconn_t *) 0x841d030
        tv = {tv_sec = 0, tv_usec = 0}
        stoptime = -1
        res = (LDAPMessage *) 0x43501170
        e = (LDAPMessage *) 0x0
        rc = 99
        sres = 0
        matched = 0x0
        ncandidates = 2
        candidate_match = 0
        i = 0
        dc = {target = 0x834e330, conn = 0x83bcc28, ctx = 0x8260ff0
"searchBase", rs = 0x429eec9c}
        is_ok = 0
        savepriv = (void *) 0x0
        candidates = (SlapReply *) 0x42e01e48
#7  0x08082f64 in fe_op_search (op=0x841c8e8, rs=0x429eec9c) at search.c:355
        entry = (Entry *) 0x429eec74
        manageDSAit = 0
...

What's odd is that rc = 99 is the result returned by ldap_result(); the
message contains:

(gdb) p ((LDAPMessage *) 0x43501170)[0]
$7 = {lm_msgid = 2819, lm_msgtype = 99, lm_ber = 0x43500ee0, lm_chain =
0x0, lm_chain_tail = 0x43501170, lm_next = 0x0, lm_time = 0}

and the ber actually looks like a search!

(gdb) p ((LDAPMessage *) 0x43501170)->lm_ber[0]
$8 = {ber_opts = {lbo_valid = 2, lbo_options = 1, lbo_debug = 261},
ber_tag = 99, ber_len = 73, ber_usertag = 0,
  ber_buf = 0x43505030
"\002\002\v\003cC\004\031ou=Meta,dc=example,dc=com\n\001\002\n\001",
  ber_ptr = 0x43505034
"cC\004\031ou=Meta,dc=example,dc=com\n\001\002\n\001", ber_end =
0x43505079 "", ber_sos = 0x0, ber_rwptr = 0x0, ber_memctx = 0x0}

p ((LDAPMessage *) 0x43501170)->lm_ber->ber_buf[0]@73
$9 =
"\002\002\v\003cC\004\031ou=Meta,dc=example,dc=com\n\001\002\n\001\000\002\001\000\002\001\000\001\001\000¤\r\004\002cn0\a\200\005james0\b\004\002cn\004\002sn"

lm_chain_tail points to the message itself.

How is it at all possible?

p.




Ing. Pierangelo Masarati
Responsabile Open Solution
OpenLDAP Core Team

SysNet s.n.c.
Via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
------------------------------------------
Office:   +39.02.23998309          
Mobile:   +39.333.4963172
Email:    pierangelo.masarati@sys-net.it
------------------------------------------