back-bdb segfault in cache.c (ITS#2682)

[rhafer@suse.de]

Full_Name: Ralf Haferkamp
Version: 2.1.22
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (212.95.103.32)


slapd segfaults in cache.c. I was able to produce the following backtrace with
gdb:

(gdb) bt full
#0  0x080a9ef7 in bdb_cache_find_entry_ndn2id (be=0x810e988, cache=0x81473f8, 
    ndn=0xbebff744) at cache.c:833
        e = {e_id = 42, e_name = {bv_len = 0, bv_val = 0x0}, e_nname = {
    bv_len = 40, 
    bv_val = 0x42f02319 "uid=user66509,ou=people,dc=home,dc=local"}, 
  e_attrs = 0xbebff744, e_ocflags = 3200251652, e_bv = {bv_len = 134686850, 
    bv_val = 0x2a <Address 0x2a out of bounds>}, e_private = 0x0}
        ep = (Entry *) 0x8160b88
        id = 262504
        count = 1
#1  0x080ad3d5 in bdb_dn2id_matched (be=0x810e988, txn=0x0, in=0xbebff8d4, 
    id=0xbebff7d0, id2=0xbebff7d4, flags=0) at dn2id.c:403
        rc = 1073973649
        key = {data = 0x42f02318, size = 42, ulen = 0, dlen = 0, doff = 0, 
  flags = 0}
        data = {data = 0xbebff7d0, size = 0, ulen = 4, dlen = 0, doff = 0, 
  flags = 32}
        bdb = (struct bdb_info *) 0x81473d8
        db = (DB *) 0x8152a58
        buf = 0x42f02318 "=uid=user66509,ou=people,dc=home,dc=local"
        dn = {bv_len = 40, 
  bv_val = 0x42f02319 "uid=user66509,ou=people,dc=home,dc=local"}
        cached_id = 1123033336
#2  0x080ac4d4 in bdb_dn2entry_rw (be=0x810e988, tid=0x0, dn=0xbebff8d4, 
    e=0xbebff820, matched=0xbebff824, flags=0, rw=1123033336, locker=58, 
    lock=0xbebff82c) at dn2entry.c:47
        rc = 1123033336
        id = 4294967295
        id2 = 0
#3  0x0809e03a in bdb_referrals (be=0x810e988, conn=0x41e860b0, op=0x42f01c38, 
    dn=0xbebff8cc, ndn=0xbebff8d4, text=0xbebff884) at referral.c:52
        bdb = (struct bdb_info *) 0x81473d8
        rc = 0
        e = (Entry *) 0x0
        matched = (Entry *) 0x0
        locker = 58
        lock = {off = 135326088, ndx = 1105748144, gen = 1123032120, 
  mode = 3200252104}
#4  0x08069475 in backend_check_referrals (be=0x815e468, conn=0x41e860b0, 
    op=0x42f01c38, dn=0x42f020f8, ndn=0x42f020f8) at backend.c:1074
        text = 0x0
        rc = 0
#5  0x08070f11 in do_delete (conn=0x41e860b0, op=0x0) at delete.c:163
        dn = {bv_len = 40, 
  bv_val = 0x8166b7e "uid=user66509,ou=people,dc=home,dc=local"}
        pdn = {bv_len = 40, 
  bv_val = 0x42f004f0 "uid=user66509,ou=people,dc=home,dc=local"}
        ndn = {bv_len = 40, 
  bv_val = 0x42f01cb8 "uid=user66509,ou=people,dc=home,dc=local"}
        text = 0x402c0baf "ë×ë\r", '\220' <repeats 13 times>, "U\211å\213E\bÇ"
        be = (Backend *) 0x42f01c38
        rc = 1105748144
        manageDSAit = 1123033336
#6  0x08059d5d in connection_operation (ctx=0x42f020f8, arg_v=0x42f01c38)
    at connection.c:932
        rc = -1094715084
        tag = 74
        oldtag = 74
        conn = (Connection *) 0x41e860b0
#7  0x40028f54 in ldap_int_thread_pool_wrapper () from /usr/lib/libldap_r.so.2
No symbol table info available.
#8  0x402bfc10 in pthread_start_thread () from /lib/libpthread.so.0
No symbol table info available.

When the server crashed, multiple clients were deleting entries others did
normal search operations.