slapd coredumps on search (ITS#1308)

[artur@surfnet.fi]

Full_Name: Artur Signell
Version: 2.0.11
OS: Redhat linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (195.197.160.14)


Slapd coredumps when searching using filter:
"(&(aktivkund=xxx)(hostaccess=xxx)(uid=xxx))" with specific values instead of
the xxx's. Changing order of filter fields or search values causes everything to
work fine. Removing "index hostaccess eq" from config-file also "fixes" the
problem, as do 
re-indexing the database.

Running:
openldap 2.0.7 & 2.0.11 on RedHat 6.2 (both RPM and tgz tested)
gdbm 1.8.0

Gdb backtrace:
#0  0x4026883b in chunk_free (ar_ptr=0x40307a00, p=0x8151080) at malloc.c:3131
#1  0x402685fc in __libc_free (mem=0x8151088) at malloc.c:3043
#2  0x80adfe8 in ber_memfree (p=0x8151088) at memory.c:156
#3  0x806362d in ch_free (ptr=0x8151088) at ch_malloc.c:103
#4  0x80889c9 in idl_free (idl=0x8151088) at idl.c:87
#5  0x8087223 in list_candidates (be=0x80f0560, flist=0xbfffc4a0, ftype=160)
    at filterindex.c:462
#6  0x80862a6 in filter_candidates (be=0x80f0560, f=0xbfffc4b0)
    at filterindex.c:87
#7  0x807e133 in search_candidates (be=0x80f0560, e=0x8136ae0,
    filter=0x811c490, scope=2, deref=0, manageDSAit=0) at search.c:429
#8  0x807d87d in ldbm_back_search (be=0x80f0560, conn=0x403664bc,
    op=0x811c3f8, base=0x811c460 "dc=aaa,dc=bbb",
    nbase=0x811c478 "DC=aaa,DC=bbb", scope=2, deref=0, slimit=0, tlimit=0,
    filter=0x811c490,
    filterstr=0x811c658 "(&(aktivkund=ccc)(hostaccess=ddd)(uid=eee))",
    attrs=0x0, attrsonly=0) at search.c:142
#9  0x8054449 in do_search (conn=0x403664bc, op=0x811c3f8) at search.c:278
#10 0x8052d10 in connection_operation (arg_v=0x8118220) at connection.c:826
#11 0x8093f2f in ldap_pvt_thread_pool_submit (pool=0x80cfc38,
    start_routine=0x8052a40 <connection_operation>, arg=0x8118220)
    at thr_stub.c:159
#12 0x8053a1f in connection_op_activate (conn=0x403664bc, op=0x811c3f8)
    at connection.c:1229
#13 0x80536e3 in connection_input (conn=0x403664bc) at connection.c:1119
#14 0x8053289 in connection_read (s=7) at connection.c:1014
#15 0x8050be3 in slapd_daemon_task (ptr=0x0) at daemon.c:1201
#16 0x8093dee in ldap_pvt_thread_create (thread=0xbffffa58, detach=0,
    start_routine=0x804f850 <slapd_daemon_task>, arg=0x0) at thr_stub.c:48
#17 0x8050e0e in slapd_daemon () at daemon.c:1264
#18 0x804de8f in main (argc=3, argv=0xbffffb24) at main.c:432
#19 0x4020c790 in __libc_start_main (main=0x804d780 <main>, argc=3,
    ubp_av=0xbffffb24, init=0x804c7e4 <_init>, fini=0x80b226c <_fini>,
    rtld_fini=0x4000d35c <_dl_fini>, stack_end=0xbffffb1c)
    at ../sysdeps/generic/libc-start.c:111