slapd crash in malloc(3bytes) (ITS#2881)

[josef.kammerloher@est.fujitsu.com]

Full_Name: Josef Kammerloher
Version: 2.1.19
OS: Solaris 8
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (192.109.29.2)


We have implemented a Java Backend which is called from the C-backend through
JNI.
It works fine, but sometimes the following crash happens.
It happens while sending a result from the Java part through JNI.
The malloc tries to allocate three bytes only.
vmstat shows a lot of free memory.
Thanks a lot,
Josef Kammerloher


t@13 (l@15) signal SEGV (no mapping at the fault address) in _smalloc at
0xfeb457ac
0xfeb457ac: _smalloc+0x0088:    ld      [%o1 + 0x8], %o0
Current function is ber_memalloc
  212                   new = malloc( s );
(/opt/SUNWspro/bin/../WS6U2/bin/sparcv9/dbx) where
current thread: t@13
  [1] _smalloc(0x8, 0xfebbc838, 0x0, 0x0, 0x0, 0xfebb5f74), at 0xfeb457ac
  [2] malloc(0x3, 0x1, 0xf1400b0f, 0xf20832f4, 0x13, 0xe6140), at 0xfeb457e8
=>[3] ber_memalloc(s = 3U), line 212 in "memory.c"
  [4] ber_strdup(s = 0x549ab8 "dn"), line 585 in "memory.c"
  [5] ldif_parse_line(line = 0x495388 "dn:
cn=FUJITSU1,ou=StressTest,dc=example,dc=com", typep = 0xf1400a10, valuep =
0xf1400a04, vlenp = 0xf1400a00), line 215 in "line64.c"
  [6] str2entry(s = 0x495388 "dn: cn=FUJITSU1,ou=StressTest,dc=example,dc=com"),
line 99 in "entry.c"
  [7] enabler_search_send_entry(result = 0x495358 "BE: 3324072TID: 13CONN:
5647192OP: 4483104ENTRY:dn: cn=FUJITSU1,ou=StressTest,dc=example,dc=com"), line
740 in "search.c"
  [8] Java_com_fujitsu_enabler_ldap_EBackendResult_enabler_1wrapper_1send_1result(jni_env
= 0x832734, jObject = 0xf1400bd8, jResultString = 0xf1400bd4), line 74 in
"wrapper.c"
  [9] 0xfa59c830(0xf2082c30, 0xf2083480, 0xf20831a0, 0xf638bfc0, 0x2, 0x10), at
0xfa59c82f
  [10] 0xfa59a988(0xf2082c30, 0xf2217ac8, 0xf2217a38, 0x0, 0xf20d1c00, 0x1), at
0xfa59a987
  [11] 0xfa5c80a8(0xf2217aa0, 0xf2217ac8, 0xf20c1f60, 0xf6352900, 0x0, 0x1), at
0xfa5c80a7
  [12] 0xfa5e6d94(0xf2217aa0, 0xf2217ac8, 0x0, 0xf20726b0, 0xf27a9a28,
0xf20b7e18), at 0xfa5e6d93
  [13] 0xfa5acee8(0xf34e2680, 0x1, 0xf2217aa0, 0xf2095030, 0xf2217bc8,
0xf2217ac8), at 0xfa5acee7
  [14] 0xfa405c64(0xf22000e8, 0xf27bc180, 0xf22024e8, 0xfa415030, 0xf61abd90,
0xf1400ec8), at 0xfa405c63
  [15] 0xfa405c64(0xf21cf480, 0xc8, 0x8, 0xfa4151f0, 0xf2200000, 0xf1400f78), at
0xfa405c63
  [16] 0xfa405b10(0xf1401080, 0x0, 0x0, 0xfa415030, 0x3611ec, 0xf1401008), at
0xfa405b0f
  [17] 0xfa400118(0xf140110c, 0xf1401330, 0xa, 0xf619a698, 0xfa40aae0,
0xf1401244), at 0xfa400117
  [18] JavaCalls::call_helper(0xf1401328, 0xf14011c0, 0xf1401228, 0x8326a8,
0x8326a8, 0x5c00), at 0xfecd4bec
  [19] jni_invoke_nonstatic(0x8326a8, 0xff03fdc8, 0x0, 0x6, 0x475b18,
0xf140130c), at 0xfeceb4bc
  [20] jni_CallObjectMethod(0x832734, 0x549684, 0x475b18, 0x0, 0x0, 0x2), at
0xfecead04
  [21] enabler_search(be = 0x32b8a8, conn = 0x562b58, op = 0x446820, base =
0xf1401ac0, nbase = 0xf1401ab8, scope = 2, deref = 0, sizelimit = -1, timelimit
= -1, filter = 0x491cf0, filterstr = 0xf1401ab0, attrs = 0x53d0f8, attrsonly =
0), line 361 in "search.c"
  [22] do_search(conn = 0x562b58, op = 0x446820), line 403 in "search.c"
  [23] connection_operation(ctx = 0x54bf30, arg_v = 0x446820), line 952 in
"connection.c"
  [24] ldap_int_thread_pool_wrapper(xpool = 0x31e7f0), line 426 in "tpool.c"
(/opt/SUNWspro/bin/../WS6U2/bin/sparcv9/dbx)