[Date Prev][Date Next] [Chronological] [Thread] [Top]

(ITS#7641) slapd crashes in slapd_free_controls when syncrepl enabled and plugins in use

Full_Name: Timothy Pearson
Version: 2.4.35
OS: Debian Wheezy
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (

slapd sporadically crashes in slapd_free_controls when syncrepl enabled and
plugins are in use.  The crash is caused by an invalid free in the slapi
overlay; it only occurs on the provider in a syncrepl setup.  This is the

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe1536700 (LWP 24523)]
*__GI___libc_free (mem=0x18) at malloc.c:3709
3709    malloc.c: No such file or directory.
(gdb) bt
#0  *__GI___libc_free (mem=0x18) at malloc.c:3709
#1  0x00007ffff7974d01 in ber_memfree_x (p=0x18, ctx=0x0) at
#2  0x00005555555c3003 in slap_free_ctrls (op=0x555555ef0c60,
ctrls=0x555555ef2570) at ../../../../servers/slapd/controls.c:569
#3  0x00005555555a41e5 in slap_send_search_entry (op=0x555555ef0c60,
rs=0x7fffe1535a40) at ../../../../servers/slapd/result.c:1476
#4  0x00007ffff1e4c465 in hdb_search (op=0x555555ef0c60, rs=0x7fffe1535a40) at
#5  0x00005555555ff1c6 in overlay_op_walk (op=0x555555ef0c60, rs=0x7fffe1535a40,
which=op_search, oi=0x5555559e5e70, on=0x0) at
#6  0x00007ffff63bfe5a in slapi_op_func (op=0x555555ef0c60, rs=0x7fffe1535a40)
at ../../../../../servers/slapd/slapi/slapi_overlay.c:650
#7  0x00005555555ff18a in overlay_op_walk (op=op@entry=0x555555ef0c60,
rs=0x7fffe1535a40, which=op_search, oi=0x5555559e5e70, on=0x5555559e6a60) at
#8  0x00005555555ff31b in over_op_func (op=0x555555ef0c60, rs=<optimized out>,
which=<optimized out>) at ../../../../servers/slapd/backover.c:723
#9  0x0000555555594641 in fe_op_search (op=0x555555ef0c60, rs=0x7fffe1535a40) at
#10 0x0000555555593f06 in do_search (op=0x555555ef0c60, rs=0x7fffe1535a40) at
#11 0x0000555555591961 in connection_operation (ctx=ctx@entry=0x7fffe1535bd0,
arg_v=arg_v@entry=0x555555ef0c60) at
#12 0x0000555555591c84 in connection_read_thread (ctx=0x7fffe1535bd0,
argv=<optimized out>) at ../../../../servers/slapd/connection.c:1286
#13 0x00007ffff7b8dfbb in ldap_int_thread_pool_wrapper (xpool=0x55555590a2e0) at
#14 0x00007ffff5d79b50 in start_thread (arg=<optimized out>) at
#15 0x00007ffff5ac3a7d in clone () at
#16 0x0000000000000000 in ?? ()

This patch fixes the problem:
--- servers/slapd/slapi/slapi_overlay.c
+++ servers/slapd/slapi/slapi_overlay.c
@@ -454,11 +454,11 @@
 	n_slapi_ctrls = slapi_int_count_controls( slapi_ctrls );
 	n_rs_ctrls = slapi_int_count_controls( rs->sr_ctrls );
-	slapi_pblock_set( pb, SLAPI_X_OLD_RESCONTROLS, (void *)rs->sr_ctrls );
 	if ( n_slapi_ctrls == 0 )
 		return LDAP_SUCCESS; /* no SLAPI controls */
+	slapi_pblock_set( pb, SLAPI_X_OLD_RESCONTROLS, (void *)rs->sr_ctrls );
 	ctrls = (LDAPControl **) op->o_tmpalloc(
 		( n_slapi_ctrls + n_rs_ctrls + 1 ) * sizeof(LDAPControl *),
 		op->o_tmpmemctx );