Issue 5541 - slapd segfaults with specific search on string bdb and hdb backend
Summary: slapd segfaults with specific search on string bdb and hdb backend
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-05-30 10:24 UTC by pwadas@jewish.org.pl
Modified: 2014-08-01 21:03 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description pwadas@jewish.org.pl 2008-05-30 10:24:21 UTC
Full_Name: Piotr Wadas
Version: 2.4.7 upto 2.4.9
OS: debian 2.6.18+ kernel
URL: 
Submission from: (NULL) (195.95.182.4)


The issue is discussed at
http://www.openldap.org/lists/openldap-software/200805/msg00136.html

List message contains debug information, steps to reproduce,
backtrace logs etc.
Issue appears since 2.4.7 in 2.4 series.


gdb bt quick ref:

#0  0xb7b4842c in free () from /usr/lib/i486-linux-gnu/i686/cmov/libc.so.6
#1  0xb7e901aa in ber_memfree_x (p=0x0, ctx=0x0) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:152
#2  0xb7e9019c in ber_memfree_x (p=0x0, ctx=0x0) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:159
#3  0xb7e90235 in ber_bvarray_free_x (a=0xa96e3354, ctx=0x8279658) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:731
#4  0xb73028e5 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa96e325c,
ids=0xa9062008, tmp=0xa8ee2008, stack=0xa90e2008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:803
#5  0xb7303064 in list_candidates (op=0x82792e0, locker=34, flist=0xa96e31ec,
ftype=160, ids=0xa8fe2008, tmp=0xa8ee2008, save=0xa9062008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:581
#6  0xb73017c7 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa96e32bc,
ids=0xa8fe2008, tmp=0xa8ee2008, stack=0xa9062008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:198
#7  0xb7303064 in list_candidates (op=0x82792e0, locker=34, flist=0xa9be2ec8,
ftype=161, ids=0xa8f62008, tmp=0xa8ee2008, save=0xa8fe2008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:581
#8  0xb73015ca in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa9be2ebc,
ids=0xa8f62008, tmp=0xa8ee2008, stack=0xa8fe2008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:204
#9  0xb7303064 in list_candidates (op=0x82792e0, locker=34, flist=0xa9be2eb0,
ftype=160, ids=0xa9b22e1c, tmp=0xa8ee2008, save=0xa8f62008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:581
#10 0xb73017c7 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa9be2ed4,
ids=0xa9b22e1c, tmp=0xa8ee2008, stack=0xa8f62008)
    at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:198
#11 0xb72fc858 in bdb_search (op=0x82792e0, rs=0xa9be4168) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/search.c:1109
#12 0x080d76f1 in overlay_op_walk (op=0x82792e0, rs=0xa9be4168, which=op_search,
oi=0x81f63d8, on=0x81f64d8) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/backover.c:646
#13 0x080d7c5d in over_op_func (op=0x82792e0, rs=0xa9be4168, which=op_search) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/backover.c:698
#14 0x08077fd3 in fe_op_search (op=0x82792e0, rs=0xa9be4168) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/search.c:366
#15 0x080787fc in do_search (op=0x82792e0, rs=0xa9be4168) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/search.c:217
#16 0x08075a9f in connection_operation (ctx=0xa9be4248, arg_v=0x82792e0) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/connection.c:1084
#17 0x08076196 in connection_read_thread (ctx=0xa9be4248, argv=0x10) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/connection.c:1211
#18 0xb7ea1d64 in ldap_int_thread_pool_wrapper (xpool=0x81b09b8) at
/home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/libldap_r/tpool.c:663
#19 0xb7c2c4fb in start_thread () from
/usr/lib/i486-linux-gnu/i686/cmov/libpthread.so.0
#20 0xb7bafe8e in clone () from /usr/lib/i486-linux-gnu/i686/cmov/libc.so.6



Comment 1 Howard Chu 2008-05-30 16:10:27 UTC
pwadas@jewish.org.pl wrote:
> Full_Name: Piotr Wadas
> Version: 2.4.7 upto 2.4.9
> OS: debian 2.6.18+ kernel
> URL:
> Submission from: (NULL) (195.95.182.4)
>
>
> The issue is discussed at
> http://www.openldap.org/lists/openldap-software/200805/msg00136.html
>
> List message contains debug information, steps to reproduce,
> backtrace logs etc.
> Issue appears since 2.4.7 in 2.4 series.

The config info you posted is missing your index configuration, which is most 
relevant here.

 From your traces, we could use a little more info as well:
frame 4
print *ava->aa_desc
print *mr
>
> gdb bt quick ref:
>
> #0  0xb7b4842c in free () from /usr/lib/i486-linux-gnu/i686/cmov/libc.so.6
> #1  0xb7e901aa in ber_memfree_x (p=0x0, ctx=0x0) at
> /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:152
> #2  0xb7e9019c in ber_memfree_x (p=0x0, ctx=0x0) at
> /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:159
> #3  0xb7e90235 in ber_bvarray_free_x (a=0xa96e3354, ctx=0x8279658) at
> /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.c:731
> #4  0xb73028e5 in bdb_filter_candidates (op=0x82792e0, locker=34, f=0xa96e325c,
> ids=0xa9062008, tmp=0xa8ee2008, stack=0xa90e2008)
>      at /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/servers/slapd/back-bdb/filterindex.c:803


-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 2 ando@openldap.org 2008-05-31 18:36:16 UTC
changed state Open to Feedback
Comment 3 pwadas@jewish.org.pl 2008-06-02 19:29:18 UTC
Hello,
Forwarding as requested, sorry for mislead.
Regards,
PW.

---------- Forwarded message ----------
Date: Mon, 02 Jun 2008 10:33:14 -0700
From: Quanah Gibson-Mount <quanah@zimbra.com>
To: Piotr Wadas <pwadas@jewish.org.pl>, openldap-software@openldap.org
Subject: Re: slapd 2.4.7-2.4.9 segfaults with some specific search

Information for your ITS should be sent to the ITS address with the bug number
in the subject, as the email you were sent after filing the ITS instructed, and
not to openldap-software.  Thanks.

--Quanah

--On May 31, 2008 8:11:46 AM +0200 Piotr Wadas <pwadas@jewish.org.pl> wrote:

> 
> Hello,
> Regarding http://www.openldap.org/its/index.cgi?findid=5541
> 
> Link to indexes file and full schema, including custom schema
> is mailed to Howard Chu, as I'd like to avoid spreading it.
> It says there's no variable "ava" nor "mr", as below
> 
> I keep gdb on detached screen, so I additional variables
> need to be printed I have'em at hand.
> 
> -------------------------------
> (gdb) print *ava->aa_desc
> No symbol "ava" in current context.
> (gdb) print *mr
> No symbol "mr" in current context.
> (gdb) print ava->aa_desc
> No symbol "ava" in current context.
> (gdb) print mr
> No symbol "mr" in current context.
> (gdb) info variables ava
> All variables matching regular expression "ava":
> 
> Non-debugging symbols:
> 0xb7cc61ac  __set_robust_list_avail
> 0xb7cc61ac  __set_robust_list_avail
> 0xb7c8d10e  not_available
> 0xb7f75da0  available_ciphers
> (gdb) info variables mr
> All variables matching regular expression "mr":
> ----------------
> 
> But I found this may be also relevant:
> 
> frame 3:
> 
> (gdb) frame 3
> # 3  0xb7f18235 in ber_bvarray_free_x (a=0xa976b354, ctx=0x8279658) at
> /home/pwadas/SRC/SLAPD/DEB249/openldap2.3-2.4.9/libraries/liblber/memory.
> c:731 731                             ber_memfree_x(a[i].bv_val, ctx);
> (gdb) info args
> a = (BerVarray) 0xa976b354
> ctx = (void *) 0x8279658
> (gdb) print *a
> $30 = {bv_len = 4, bv_val = 0xa976b36c "\200"}
> (gdb) print *a->bv_val
> $31 = -128 '\200'
> 
> frame 4
> 
> 
> $44 =
> {
>   o_hdr = 0x82793b8, o_tag = 99, o_time = 1212212344, o_tincr = 1, o_bd =
>     0xa9c6af80, o_req_dn =
>   {
>   bv_len = 29, bv_val = 0xa976b154 "dc=dns,dc=nameservers,dc=com,dc=eu"}
>   , o_req_ndn =
>   {
>   bv_len = 29, bv_val = 0xa976b1a4 "dc=dns,dc=nameservers,dc=com,dc=eu"}
>   , o_request =
>   {
>     oq_add =
>     {
>     rs_modlist = 0x2, rs_e = 0x0}
>     , oq_bind =
>     {
>       rb_method = 2, rb_cred =
>       {
>       bv_len = 0, bv_val = 0xffffffff < Address 0xffffffff out of bounds
> >}       , rb_edn =
>       {
>       bv_len = 4294967295, bv_val = 0x0}
>       , rb_ssf = 0, rb_mech =
>       {
>       bv_len = 0, bv_val = 0xa976b2bc " "}
>     }
>     , oq_compare =
>     {
>     rs_ava = 0x2}
>     , oq_modify =
>     {
>       rs_mods =
>       {
>       rs_modlist = 0x2, rs_no_opattrs = 0 '\0'}
>     , rs_increment = -1}
>     , oq_modrdn =
>     {
>       rs_mods =
>       {
>       rs_modlist = 0x2, rs_no_opattrs = 0 '\0'}
>       , rs_deleteoldrdn = -1, rs_newrdn =
>       {
>       bv_len = 4294967295, bv_val = 0x0}
>       , rs_nnewrdn =
>       {
>       bv_len = 0, bv_val = 0x0}
>     , rs_newSup = 0xa976b2bc, rs_nnewSup = 0x79}
>     , oq_search =
>     {
>       rs_scope = 2, rs_deref = 0, rs_slimit = -1, rs_tlimit =
> 	-1, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs =
> 	0x0, rs_filter = 0xa976b2bc, rs_filterstr =
>       {
>       bv_len = 121, bv_val =
> 	  0xa976b2cc
> 
> "(&(objectClass=dNSDomain)(associatedDomain=*fakedomain.com)(customerID=1
> 0125)(sOARecord=*)(nSRecord=*)(topLevelDomain=TRUE))"}     }
>     , oq_abandon =
>     {
>     rs_msgid = 2}
>     , oq_cancel =
>     {
>     rs_msgid = 2}
>     , oq_extended =
>     {
>       rs_reqoid =
>       {
>       bv_len = 2, bv_val = 0x0}
>     , rs_flags = -1, rs_reqdata = 0xffffffff}
>     , oq_pwdexop =
>     {
>       rs_extended =
>       {
> 	rs_reqoid =
> 	{
> 	bv_len = 2, bv_val = 0x0}
>       , rs_flags = -1, rs_reqdata = 0xffffffff}
>       , rs_old =
>       {
>       bv_len = 0, bv_val = 0x0}
>       , rs_new =
>       {
>       bv_len = 0, bv_val = 0xa976b2bc " "}
>     , rs_mods = 0x79, rs_modtail = 0xa976b2cc}
>   }
>   , o_abandon = 0, o_cancel = 0, o_groups = 0x0,
>     o_do_not_cache = 0 '\0', o_is_auth_check = 0 '\0', o_acl_priv =
>     ACL_NONE, o_nocaching = 0 '\0', o_delete_glue_parent =
>     0 '\0', o_no_schema_check = 0 '\0', o_no_subordinate_glue =
>     0 '\0', o_ctrlflag = '\0' < repeats 31 times >, o_controls =
>     0x82794e4, o_authz =
>   {
>     sai_method = 128, sai_mech =
>     {
>     bv_len = 0, bv_val = 0x0}
>     , sai_dn =
>     {
>     bv_len = 28, bv_val = 0x8279b70 "cn=Directory Manager,dc=com,dc=eu"}
>     , sai_ndn =
>     {
>     bv_len = 28, bv_val = 0x8279b98 "cn=directory manager,dc=com,dc=eu"}
>   , sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}
>   , o_ber = 0x8264b98, o_res_ber = 0x0, o_callback =
>     0xa9c6b07c, o_ctrls = 0x0, o_csn =
>   {
>   bv_len = 0, bv_val = 0x0}
>   , o_private = 0x0, o_extra =
>   {
>   slh_first = 0x0}
>   , o_next =
>   {
>   stqe_next = 0x0}
> }
> 



--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration
Comment 4 Howard Chu 2008-06-02 19:39:54 UTC
pwadas@jewish.org.pl wrote:
>    This message is in MIME format.  The first part should be readable text,
>    while the remaining parts are likely unreadable without MIME-aware tools.

Looks like you didn't have the correct frame selected before issuing those 
print commands.

At any rate, I suspect this issue has already been fixed in the 2.4.10 release 
candidate. Please test with the 2.4 release in CVS.

>> =20
>> Hello,
>> Regarding http://www.openldap.org/its/index.cgi?findid=3D5541
>> =20
>> Link to indexes file and full schema, including custom schema
>> is mailed to Howard Chu, as I'd like to avoid spreading it.
>> It says there's no variable "ava" nor "mr", as below
>> =20
>> I keep gdb on detached screen, so I additional variables
>> need to be printed I have'em at hand.
>> =20
>> -------------------------------
>> (gdb) print *ava->aa_desc
>> No symbol "ava" in current context.
>> (gdb) print *mr
>> No symbol "mr" in current context.
>> (gdb) print ava->aa_desc
>> No symbol "ava" in current context.
>> (gdb) print mr
>> No symbol "mr" in current context.


-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 5 pwadas@jewish.org.pl 2008-06-02 21:25:29 UTC
It works as expected with CVS current OPENLDAP_REL_ENG_2_4
version (didn't test -devel version),
Deep respect & many thanks for your amazing work with free ldap software -
Piotr Wadas

On Mon, 2 Jun 2008, Howard Chu wrote:

> pwadas@jewish.org.pl wrote:
> >    This message is in MIME format.  The first part should be readable text,
> >    while the remaining parts are likely unreadable without MIME-aware tools.
> 
> Looks like you didn't have the correct frame selected before issuing those
> print commands.
> 
> At any rate, I suspect this issue has already been fixed in the 2.4.10 release
> candidate. Please test with the 2.4 release in CVS.
> 
> > > =20
> > > Hello,
> > > Regarding http://www.openldap.org/its/index.cgi?findid=3D5541
> > > =20
> > > Link to indexes file and full schema, including custom schema
> > > is mailed to Howard Chu, as I'd like to avoid spreading it.
> > > It says there's no variable "ava" nor "mr", as below
> > > =20
> > > I keep gdb on detached screen, so I additional variables
> > > need to be printed I have'em at hand.
> > > =20
> > > -------------------------------
> > > (gdb) print *ava->aa_desc
> > > No symbol "ava" in current context.
> > > (gdb) print *mr
> > > No symbol "mr" in current context.
> > > (gdb) print ava->aa_desc
> > > No symbol "ava" in current context.
> > > (gdb) print mr
> > > No symbol "mr" in current context.
> 
> 
> 

Comment 6 Howard Chu 2008-06-02 22:13:57 UTC
Piotr Wadas wrote:
> It works as expected with CVS current OPENLDAP_REL_ENG_2_4
> version (didn't test -devel version),
> Deep respect&  many thanks for your amazing work with free ldap software -

Thanks for the feedback, glad it's working for you.
This ITS will be closed.

> Piotr Wadas
>
> On Mon, 2 Jun 2008, Howard Chu wrote:
>
>> pwadas@jewish.org.pl wrote:
>>>     This message is in MIME format.  The first part should be readable text,
>>>     while the remaining parts are likely unreadable without MIME-aware tools.
>> Looks like you didn't have the correct frame selected before issuing those
>> print commands.
>>
>> At any rate, I suspect this issue has already been fixed in the 2.4.10 release
>> candidate. Please test with the 2.4 release in CVS.
>>
>>>> =20
>>>> Hello,
>>>> Regarding http://www.openldap.org/its/index.cgi?findid=3D5541
>>>> =20
>>>> Link to indexes file and full schema, including custom schema
>>>> is mailed to Howard Chu, as I'd like to avoid spreading it.
>>>> It says there's no variable "ava" nor "mr", as below
>>>> =20
>>>> I keep gdb on detached screen, so I additional variables
>>>> need to be printed I have'em at hand.
>>>> =20
>>>> -------------------------------
>>>> (gdb) print *ava->aa_desc
>>>> No symbol "ava" in current context.
>>>> (gdb) print *mr
>>>> No symbol "mr" in current context.
>>>> (gdb) print ava->aa_desc
>>>> No symbol "ava" in current context.
>>>> (gdb) print mr
>>>> No symbol "mr" in current context.
>>
>>
>


-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 7 Howard Chu 2008-06-02 22:15:19 UTC
changed notes
changed state Feedback to Closed
Comment 8 OpenLDAP project 2014-08-01 21:03:32 UTC
already fixed in RE24/2.4.10