Re: SEGFAULT with NULL backend suffix definition (ITS#23)

[starder@rosinter.ru]

Hi there!

>>when I issued ldapsearch "objectclass=*" server does not respond at ALL.
>>on next same search server dumped with segfault in strcasecmp (called from
>>be_isroot()).
>
>Please provide a back trace ('bt') from the segfault and relevant log
>(-d 1) entries.

Backtrace from "gdb slapd slapd.core"

(gdb) bt
#0  0x280d818a in strcasecmp ()
#1  0x80501fe in be_isroot (be=0x8070800,
    dn=0xffffffff <Address 0xffffffff out of bounds>) at
backend.c:204
#2  0x8054b6a in acl_get_applicable (be=0x8070800, op=0x80a9380,
e=0x80a92c0,
    attr=0x8072210 "c", edn=0x80722c0 "C=RU", nmatch=10,
matches=0x80cbe60)
    at acl.c:119
#3  0x8050a33 in send_search_entry (be=0x8070800, conn=0x808740c,
    op=0x80a9380, e=0x80a92c0, attrs=0x0, attrsonly=0) at
result.c:250
#4  0x806095b in ldbm_back_search (be=0x8070800, conn=0x808740c,
op=0x80a9380,
    base=0x80721b0 "", scope=2, deref=0, slimit=499, tlimit=3600,
    filter=0x806e4a0, filterstr=0x80721d0 "(objectclass=*)",
attrs=0x0,
    attrsonly=0) at search.c:258
#5  0x804be25 in do_search (conn=0x808740c, op=0x80a9380) at
search.c:169
#6  0x804b4da in connection_operation (arg_v=0x8072180) at
connection.c:74
#7  0x2809238e in _thread_start ()
(gdb)

redirection of "slapd -f slapd.conf -d 1"

slapd 1.1.1-Release (    27     1998 19:03:49 MSK)
        starder@cannon:/usr/home/starder/111/ldap/servers/slapd
slapd starting
do_bind
do_bind: version 2 dn () method 128
send_ldap_result 0::
do_search
select_backend: use default backend
using base
subtree_candidates: base:
=> filter_candidates
=> list_candidates 0xa1
=> filter_candidates
=> ava_candidates 0xa3
=> index_read( "objectclass" "=" "REFERRAL" )
=> ldbm_cache_open( "/usr/tmp/objectclass.dbb", 514, 600 )
<= ldbm_cache_open (opened 0)
<= index_read 0 candidates
<= ava_candidates 0
<= filter_candidates 0
=> filter_candidates
=> presence_candidates
=> index_read( "objectclass" "^@" "*" )
<= index_read 2 candidates (allids - not indexed)
<= presence_candidates 2
<= filter_candidates 2
<= list_candidates 2
<= filter_candidates 2
=> id2entry_r( 1 )
=> ldbm_cache_open( "/usr/tmp/id2entry.dbb", 514, 600 )
<= ldbm_cache_open (opened 1)
=> str2entry
<= str2entry 0x80a92c0
<= id2entry_r( 1 ) (disk)
/* At this point, op already changed. i think it's occured in
id2entry_r */
=> send_search_entry (c=ru)
<= send_search_entry
====> cache_return_entry_r
send_ldap_result 0::
slapd in free(): warning: junk pointer, too high to make sense. /* 
warning while delete_op()*/
ber_get_next on fd 7 failed errno 0 (Undefined error: 0)
*** got 0 of 0 so far
/* ldapsearch still waiting for result ..... killed */
/* Second execution of ldapsearch -h host -b "" "objectclass=*" */
do_bind
do_bind: version 2 dn () method 128
send_ldap_result 0::
do_search
select_backend: use default backend
using base
subtree_candidates: base:
subtree_candidates: base:
=> filter_candidates
=> list_candidates 0xa1
=> filter_candidates
=> ava_candidates 0xa3
=> index_read( "objectclass" "=" "REFERRAL" )
=> ldbm_cache_open( "/usr/tmp/objectclass.dbb", 514, 600 )
<= ldbm_cache_open (cache 0)
<= index_read 0 candidates
<= ava_candidates 0
<= filter_candidates 0
=> filter_candidates
=> presence_candidates
=> index_read( "objectclass" "^@" "*" )
<= index_read 2 candidates (allids - not indexed)
<= presence_candidates 2
<= filter_candidates 2
<= list_candidates 2
<= filter_candidates 2
=> id2entry_r( 1 )
====> cache_find_entry_dn2id: found id: 1 rw: 0
<= id2entry_r 0x80a92c0 (cache)
=> send_search_entry (c=ru)
/* core dumped. Segfault on 2.2.6 and Bus error on 3.0*/

BTW 1.0 and 1.1 as i wrote, working fine with the same config and the
same database.
Alex Iliynsky [starder@rosinter.ru] FIDO 2:5020/23.0@fidonet.org
JV RosInter Communication and Network Department