LDAP_OPERATIONS_ERROR search causing server to dump core (ITS#1233)

[jasonw@unitree.com]

Full_Name: Jason Wells
Version: 2.0.11
OS: SunOS 2.6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (209.212.180.162)


I am running openldap V. 2.0.11 on SunOS 5.6. When I do a search as shown below,
the server crashes (most of the time). I have full syslogging turned on and can
find nothing meaningful from the syslog. The directory itself is very small and
simple. I cannot figure out why in the world it would be having problems all of
a sudden. I can recompile ldap with -g if necesary.

It looks like __eprintf() is calling abort for some reason.

When is the 2.0.12 comming out? Have changed much since 2.0.11?

Thanks,
	Jason Wells

ldapsearch -L -H ldap://tugrik -s sub -b "ou=cookieSecrets, ou=backupinfo,
dc=unitree, dc=com" "(&(objectClass=cookieSecret)(version=1))"

/var/adm/messages:

Jul 12 14:03:08 tugrik slapd[23901]: slapd starting
Jul 12 14:03:10 tugrik slapd[23901]: daemon: conn=0 fd=7 connection from
IP=192.168.1.60:4207 (IP=129.1.1.0:65279) accepted.
Jul 12 14:03:10 tugrik slapd[23901]: conn=0 op=0 BIND dn="" method=128
Jul 12 14:03:10 tugrik slapd[23901]: conn=0 op=0 RESULT tag=97 err=0 text=
=================================================================================
LDIF:

dn: cn=Manager,dc=unitree,dc=com
objectClass: organizationalRole
cn: Manager
 
dn: version=1, ou=cookieSecrets, ou=backupinfo, dc=unitree, dc=com
objectClass: cookieSecret
ou: backupinfo
ou: cookieSecrets
version: 1
secret: zacate
 
dn: ou=cookieSecrets, ou=backupinfo, dc=unitree, dc=com
objectClass: organizationalUnit
ou: backupinfo
ou: cookieSecrets
 
dn: ou=tickets, ou=backupinfo, dc=unitree, dc=com
objectClass: organizationalUnit
ou: backupinfo
ou: tickets
 
dn: dc=unitree,dc=com
objectClass: dcObject
objectClass: organization
o: Unitree Software Inc.
dc: unitree
 
dn: ou=backupinfo, dc=unitree, dc=com
objectClass: organizationalUnit
ou: backupinfo
========================================================================
gdb output:

bash-2.04# gdb libexec/slapd core
GNU gdb 4.17
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.6"...
(no debugging symbols found)...
Core was generated by `libexec/slapd -f etc/openldap/slapd.conf'.
Program terminated with signal 9, Killed.
Reading symbols from /backup_one/lib/libgdbm.so.2...
(no debugging symbols found)...done.
Reading symbols from /usr/lib/libresolv.so.2...(no debugging symbols found)...
done.
Reading symbols from /usr/lib/libnsl.so.1...(no debugging symbols found)...
done.
Reading symbols from /usr/lib/libsocket.so.1...(no debugging symbols found)...
done.
Reading symbols from /usr/lib/libdl.so.1...(no debugging symbols found)...done.
Reading symbols from /usr/lib/libpthread.so.1...(no debugging symbols found)...
done.
Reading symbols from /usr/lib/libc.so.1...(no debugging symbols found)...done.
Reading symbols from /usr/lib/libmp.so.2...(no debugging symbols found)...done.
Reading symbols from /usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1...
(no debugging symbols found)...done.
Reading symbols from /usr/lib/libthread.so.1...(no debugging symbols found)...
done.
#0  0xef5534d4 in __sigprocmask ()
(gdb) where
#0  0xef5534d4 in __sigprocmask ()
#1  0xef54b070 in _resetsig ()
#2  0xef54a934 in _sigon ()
#3  0xef54d548 in _thrp_kill ()
#4  0xef5ba568 in abort ()
#5  0x6ce50 in __eprintf ()
#6  0x3e2ac in caseIgnoreIA5SubstringsFilter ()
#7  0x2fc04 in value_normalize ()
#8  0x2fedc in get_ava ()
#9  0x22f80 in get_filter ()
#10 0x23854 in get_filter ()
#11 0x233dc in get_filter ()
#12 0x22834 in do_search ()
#13 0x2188c in connection_done ()
#14 0x57ea0 in ldap_pvt_thread_pool_destroy ()
(gdb)