JNDI client crashes slapd when binding across referral (slapd debug)

[Mark Diggory <mdiggory@latte.harvard.edu>]

I've posted this issue on the software site with some output. Here I 
will provide all the debugging info I know how to get from both JNDI and 
slapd as well as client code and example ldif entries. This issue 
arrises on version 2.0.7 with JNDI client version 1.2 and LDAP service 
provider 1.2.2 or 1.2.1 I'm binding using LDAP version3 protocols. slap 
crashes during attempt to bind to an entry who's dn contains a referral 
to another server.

here is the slapd output with debug set to -1

daemon: activity on 1 descriptors
daemon: activity on: 10r
daemon: read activity on 10
connection_get(10)
connection_get(10): got connid=1
connection_read(10): checking for input on id=1
ber_get_next
sockbuf_read: want=1, got=1
 0000:  30                                                 0                 
sockbuf_read: want=1, got=1
 0000:  3b                                                 ;                 
sockbuf_read: want=59, got=59
 0000:  02 01 02 63 36 04 16 6f  75 3d 76 64 63 69 64 2c   ...c6..ou=vdcid,  
 0010:  6f 75 3d 68 6d 64 63 2c  6f 3d 76 64 63 0a 01 02   ou=hmdc,o=vdc...  
 0020:  0a 01 03 02 01 00 02 01  00 01 01 00 87 0b 6f 62   ..............ob  
 0030:  6a 65 63 74 43 6c 61 73  73 30 00                  jectClass0.       
ber_get_next: tag 0x30 len 59 contents:
ber_dump: buf=0x08176388 ptr=0x08176388 end=0x081763c3 len=59
 0000:  02 01 02 63 36 04 16 6f  75 3d 76 64 63 69 64 2c   ...c6..ou=vdcid,  
 0010:  6f 75 3d 68 6d 64 63 2c  6f 3d 76 64 63 0a 01 02   ou=hmdc,o=vdc...  
 0020:  0a 01 03 02 01 00 02 01  00 01 01 00 87 0b 6f 62   ..............ob  
 0030:  6a 65 63 74 43 6c 61 73  73 30 00                  jectClass0.       
ber_get_next
sockbuf_read: want=1 error=Resource temporarily unavailable
ber_get_next on fd 10 failed errno=11 (Resource temporarily unavailable)
do_search
ber_scanf fmt ({aiiiib) ber:
ber_dump: buf=0x08176388 ptr=0x0817638b end=0x081763c3 len=56
 0000:  63 36 04 16 6f 75 3d 76  64 63 69 64 2c 6f 75 3d   c6..ou=vdcid,ou=  
 0010:  68 6d 64 63 2c 6f 3d 76  64 63 0a 01 02 0a 01 03   hmdc,o=vdc......  
 0020:  02 01 00 02 01 00 01 01  00 87 0b 6f 62 6a 65 63   ...........objec  
 0030:  74 43 6c 61 73 73 30 00                            tClass0.          
SRCH "ou=vdcid,ou=hmdc,o=vdc" 2 3    0 0 0
begin get_filter
PRESENT
ber_scanf fmt (o) ber:
ber_dump: buf=0x08176388 ptr=0x081763b4 end=0x081763c3 len=15
 0000:  87 0b 6f 62 6a 65 63 74  43 6c 61 73 73 30 00      ..objectClass0.   
end get_filter 0
   filter: (objectClass=*)
ber_scanf fmt ({v}}) ber:
ber_dump: buf=0x08176388 ptr=0x081763c1 end=0x081763c3 len=2
 0000:  30 00                                              0.                
   attrs:
conn=1 op=1 SRCH base="ou=vdcid,ou=hmdc,o=vdc" scope=2 filter="(objectClass=*)"
=> ldbm_back_search
dn2entry_r: dn: "OU=VDCID,OU=HMDC,O=VDC"
=> dn2id( "OU=VDCID,OU=HMDC,O=VDC" )
=> ldbm_cache_open( "/usr/local/var/openldap-ldbm/dn2id.dbb", 7, 600 )
<= ldbm_cache_open (cache 0)
<= dn2id NOID
dn2entry_r: dn: "OU=HMDC,O=VDC"
=> dn2id( "OU=HMDC,O=VDC" )
====> cache_find_entry_dn2id("OU=HMDC,O=VDC"): 1136 (1 tries)
<= dn2id 1136 (in cache)
=> id2entry_r( 1136 )
entry_rdwr_rtrylock: ID: 1136
====> cache_find_entry_id( 1136 ) "ou=hmdc, o=vdc" (found) (1 tries)
<= id2entry_r( 1136 ) 0x81770e0 (cache)
entry_rdwr_runlock: ID: 1136
====> cache_return_entry_r( 1136 ): returned (0)
send_ldap_result: conn=1 op=1 p=3
send_ldap_result: 32:ou=hmdc, o=vdc:
send_ldap_result: referral: ldap://vdc.fas.harvard.edu/ou=hmdc,o=vdc
send_ldap_response: msgid=2 tag=101 err=32
send_ldap_response: ref=ldap://vdc.fas.harvard.edu/ou=hmdc,o=vdc
slapd: result.c:285: send_ldap_response: Assertion `err == 0x0a' failed.
Abort
[mdiggory@lorien libexec]$