(ITS#7355) slapd reproducible segfaults deleting memberof from cn=config

[daniel@pluta.biz]

Full_Name: Daniel Pluta
Version: HEAD
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (84.167.95.124)


Steps to reproduce:

0.) slapd version: HEAD (git master pulled today)

1.) slapd.conf:
include         /opt/openldap-acl/etc/openldap/schema/core.schema
pidfile         /opt/openldap-acl/var/run/slapd.pid
argsfile        /opt/openldap-acl/var/run/slapd.args
modulepath      /opt/openldap-acl/libexec/openldap

moduleload      memberof.la

access to *
 by self write
 by users read
 by anonymous auth

database                config
rootdn                  "cn=Manager,cn=config"
rootpw                  secret

database                mdb
suffix                  "o=test"
rootdn                  "cn=Manager,o=test"
rootpw                  secret
directory               /opt/openldap-acl/var/openldap-data/test
index                   objectClass     eq

overlay                 memberof
memberof-group-oc       groupOfNames
memberof-member-ad      member
memberof-memberof-ad    memberOf
memberof-dangling       ignore
memberof-refint         FALSE

2.) conversion to slapd.d:
/opt/openldap-acl/sbin/slaptest -f slapd.conf.acl -F slapd.d

3.) slapd start:
slapd -F slapd.d -u openldap -g openldap -l local4 -d 1 \
-h "ldap://0.0.0.0:1389/ ldapi://%2Fopt%2Fopenldap%2Fvar%2Frun%2Fldapi_acl/"

4.) delete_memberof.ldif:
dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
changetype: delete


5.) ldapmodify:
cat delete_memberof.ldif | ldapmodify -x -H "ldap://localhost:1389/"; -D
"cn=Manager,cn=config" -w secret


Result:

502c9eeb slap_listener_activate(7):
502c9eeb >>> slap_listener(ldap://0.0.0.0:1389/)
502c9eeb connection_get(11): got connid=1000
502c9eeb connection_read(11): checking for input on id=1000
ber_get_next
ber_get_next: tag 0x30 len 38 contents:
502c9eeb op tag 0x60, time 1345101547
ber_get_next
502c9eeb conn=1000 op=0 do_bind
ber_scanf fmt ({imt) ber:
ber_scanf fmt (m}) ber:
502c9eeb >>> dnPrettyNormal: <cn=Manager,cn=config>
502c9eeb <<< dnPrettyNormal: <cn=Manager,cn=config>, <cn=manager,cn=config>
502c9eeb do_bind: version=3 dn="cn=Manager,cn=config" method=128
502c9eeb do_bind: v3 bind: "cn=Manager,cn=config" to "cn=Manager,cn=config"
502c9eeb send_ldap_result: conn=1000 op=0 p=3
502c9eeb send_ldap_response: msgid=1 tag=97 err=0
ber_flush2: 14 bytes to sd 11
502c9eeb connection_get(11): got connid=1000
502c9eeb connection_read(11): checking for input on id=1000
ber_get_next
ber_get_next: tag 0x30 len 56 contents:
502c9eeb op tag 0x4a, time 1345101547
ber_get_next
502c9eeb conn=1000 op=1 do_delete
ber_scanf fmt (m) ber:
502c9eeb >>> dnPrettyNormal:
<olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config>
502c9eeb <<< dnPrettyNormal:
<olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config>,
<olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config>
Segmentation fault