Issue 357 - slapd crash report
Summary: slapd crash report
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 1999-11-05 16:24 UTC by wowa@jetinf.com
Modified: 2014-08-01 21:06 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description wowa@jetinf.com 1999-11-05 16:24:41 UTC
Full_Name: Vladimir V. Tsichevski
Version: 1.2.7 and more recent
OS: SPARC Solaris 2.6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (194.87.88.135)


Hi,

got repeatable slapd server crash when I try to remove the ENTIRE
ATTRIBUTE CONTENTS of INDEXED ATTRIBUTE.

According to ldap_modify man page

       ... If the entire attribute is to be deleted, the
       mod_values   field   should   be   set   to   NULL...

I was trying to remove all the indexed uid attribute. Got Segmentation 
fault in slapd. The reason is in vals=0x0.


(gdb) where
#0  index_change_values (be=0x5f380, type=0x458128 "uid", vals=0x0, id=10, op=0)
at index.c:305
#1  0x2fc48 in index_add_mods (be=0x5f380, mods=0x3588a8, id=10) at index.c:92
#2  0x30d18 in ldbm_internal_modify (be=0x5f380, conn=0x67e50, op=0x25dd08, 
    dn=0x4567d0 "OU=FINANCIAL,O=JET,DC=JET,DC=MSK,DC=SU", mods=0x458418,
e=0x60ed8) at modify.c:192
#3  0x30e60 in ldbm_back_modify (be=0x5f380, conn=0x67e50, op=0x25dd08, 
    dn=0x4567d0 "OU=FINANCIAL,O=JET,DC=JET,DC=MSK,DC=SU", mods=0x3588a8) at
modify.c:236
#4  0x21ac4 in do_modify (conn=0x67e50, op=0x25dd08) at modify.c:157
#5  0x194d8 in connection_operation (arg_v=0x358d00) at connection.c:66
#6  0x3e0f4 in ldap_pvt_thread_create (thread=0x25dd30, detach=1, 
    start_routine=0x193e8 <connection_operation>, arg=0x358d00) at
thr_stub.c:40
#7  0x19b38 in connection_activity (conn=0x67e50) at connection.c:207
#8  0x19104 in slapd_daemon (port=0x5c680) at daemon.c:362
#9  0x3e0f4 in ldap_pvt_thread_create (thread=0x5c29c, detach=0,
start_routine=0x17cc4 <slapd_daemon>, 
    arg=0x185) at thr_stub.c:40
#10 0x17818 in main (argc=3, argv=0xeffffa24) at main.c:211

Comment 1 Kurt Zeilenga 1999-11-05 18:07:19 UTC
moved from Incoming to Software Bugs
Comment 2 Kurt Zeilenga 1999-11-17 22:00:51 UTC
At 04:24 PM 11/5/99 GMT, wowa@jetinf.com wrote:
>Full_Name: Vladimir V. Tsichevski
>Version: 1.2.7 and more recent
>OS: SPARC Solaris 2.6
>URL: ftp://ftp.openldap.org/incoming/
>Submission from: (NULL) (194.87.88.135)
>
>(gdb) where
>#0  index_change_values (be=0x5f380, type=0x458128 "uid", vals=0x0, id=10, op=0)
>at index.c:305

Line #305 of index.c (as released with 1.2.7) is:

        Debug( LDAP_DEBUG_ANY,
               "<= index_change_values (couldn't open(%s%s),md=%s)\n",
               at_cn,  
               LDBM_SUFFIX,   
               ((mode==LDBM_WRCREAT)?"LDBM_WRCREAT":"LDBM_WRITER") );

I would suspect that problem is that at_cn is NULL.  Can you
verify with the debugger.

----
Kurt D. Zeilenga		<kurt@boolean.net>
Net Boolean Incorporated	<http://www.boolean.net/>
Comment 3 Tsyshevsky Vladimir 1999-11-18 06:18:20 UTC
>X-Sender: guru@localhost
>Date: Wed, 17 Nov 1999 14:00:51 -0800
>From: "Kurt D. Zeilenga" <kurt@boolean.net>
>Cc: openldap-its@OpenLDAP.org
>
>At 04:24 PM 11/5/99 GMT, wowa@jetinf.com wrote:
>>Full_Name: Vladimir V. Tsichevski
>>Version: 1.2.7 and more recent
>>OS: SPARC Solaris 2.6
>>URL: ftp://ftp.openldap.org/incoming/
>>Submission from: (NULL) (194.87.88.135)
>>
>>(gdb) where
>>#0  index_change_values (be=0x5f380, type=0x458128 "uid", vals=0x0, id=10, op=0)
>>at index.c:305
>
>Line #305 of index.c (as released with 1.2.7) is:
>
>        Debug( LDAP_DEBUG_ANY,
>               "<= index_change_values (couldn't open(%s%s),md=%s)\n",
>               at_cn,  
>               LDBM_SUFFIX,   
>               ((mode==LDBM_WRCREAT)?"LDBM_WRCREAT":"LDBM_WRITER") );
>
>I would suspect that problem is that at_cn is NULL.  Can you
>verify with the debugger.
>
>----
>Kurt D. Zeilenga		<kurt@boolean.net>
>Net Boolean Incorporated	<http://www.boolean.net/>
>

No, the problem is in NULL value of 'vals' argument of
index_change_values. It is used without checking (line 305):

	for ( i = 0; vals[i] != NULL; i++ ) {

as for at_cn value, it was not used in the debug statement you've
mentioned, since the index file was opened successfully.

I cannot fix the problem by myself, cause probably the big part of program
should be redesigned. If we want to remove the whole attribute, which
values are indexed, then we need to remove index entries BEFORE we know the keys.
Comment 4 Kurt Zeilenga 2000-03-20 14:02:31 UTC
changed notes
Comment 5 Kurt Zeilenga 2000-03-20 14:02:46 UTC
changed state Open to Feedback
Comment 6 Kurt Zeilenga 2000-03-20 14:05:03 UTC
changed state Feedback to Closed
Comment 7 OpenLDAP project 2014-08-01 21:06:53 UTC
Believed fix prior 1.2.7.