unexpected cores from ldap_parse_result (ITS#1546)

[chopin@sgh.waw.pl]

Full_Name: Piotr Kucharski
Version: 2.0.21
OS: Solaris 2.6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (193.41.120.12)


Having wanted to authenticate users on host1 (solaris) against LDAP, I installed
openldap setup on host2 (freebsd), works fine, transferred /etc/passwd, works
ok; trying ldapsearch, no problem, even with TLS/SSL -- users can read their
entries, including userPassword and authenticate to slapd with their (still
crypted) passwords.

So pam_ldap now, got one from www.padl.com, installed, no errors. Changed
/etc/pam.conf, adding:
telnet  auth sufficient /usr/lib/security/pam_ldap.so.1

When I telnet to host1 and enter user and pass (any), connection closes due to
telnet/login core.
(gdb) bt
#0  0xef5c7800 in _free_unlocked () from /usr/lib/libc.so.1
#1  0xef5c77b8 in free () from /usr/lib/libc.so.1
#2  0xef5068e8 in ber_memfree (p=0x1) at memory.c:156
#3  0xef52a688 in ldap_parse_result (ld=0x2dec8, r=0x29f20,
errcodep=0xeffff27c,
    matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0)
    at error.c:254
#4  0xef52a4cc in ldap_result2error (ld=0x2dec8, r=0x29f20, freeit=0) at
error.c:171
#5  0xef52bf04 in ldap_search_s (ld=0x2dec8,
    base=0x294a0 "ou=People,dc=sgh,dc=waw,dc=pl", scope=2,
    filter=0xeffff770 "(uid=chopin)", attrs=0x0, attrsonly=0, res=0xeffff36c)
    at search.c:954
#6  0xef564428 in _get_user_info (session=0x2b0d8, user=0x28bc8 "chopin")
    at pam_ldap.c:1947
#7  0xef5649f4 in _do_authentication (session=0x2b0d8, user=0x28bc8 "chopin",
    password=0x28c98 "a") at pam_ldap.c:2211
#8  0xef56517c in pam_sm_authenticate (pamh=0x29090, flags=0, argc=0, argv=0x0)
    at pam_ldap.c:2608
#9  0xef732258 in pam_authenticate () from /usr/lib/libpam.so.1
#10 0x12730 in main ()
#11 0x13a4c in main ()
#12 0x11fe0 in main ()

(gdb) frame 3
#3  0xef52a688 in ldap_parse_result (ld=0x2dec8, r=0x29f20,
errcodep=0xeffff27c,
    matcheddnp=0x0, errmsgp=0x0, referralsp=0x0, serverctrls=0x0, freeit=0)
    at error.c:254
254                     LDAP_FREE( ld->ld_matched );
(gdb) p ld->ld_matched
$7 = 0x1 <Address 0x1 out of bounds>
(gdb) p *ld
$8 = {ld_sb = 0x295e0, ld_options = {ldo_valid = 2, ldo_debug = 0, ldo_tm_api =
0x0,
    ldo_tm_net = 0x0, ldo_version = 2, ldo_deref = 0, ldo_timelimit = 0,
    ldo_sizelimit = 0, ldo_tls_mode = 0, ldo_defludp = 0x2af70, ldo_defport =
389,
    ldo_defbase = 0x29e60 "dc=sgh,dc=waw,dc=pl", ldo_defbinddn = 0x0,
    ldo_refhoplimit = 5, ldo_sctrls = 0x0, ldo_cctrls = 0x0,
    ldo_rebindproc = 0xef563990 <_rebind_proc>, ldo_booleans = 1},
ld_lberoptions = 1,
  ld_filtd = 0x3, ld_ufnprefix = 0x0, ld_errno = 0, ld_error = 0x0,
  ld_matched = 0x1 <Address 0x1 out of bounds>, ld_msgid = 2, ld_requests =
0x0,
  ld_responses = 0x0, ld_abandoned = 0x0, ld_cache = 0x0, ld_defconn = 0x2af40,
  ld_conns = 0x2af40, ld_selectinfo = 0x2a8e0}

Worth to note, that:
(gdb) fr 6
#6  0xef564428 in _get_user_info (session=0x2b0d8, user=0x28bc8 "chopin")
    at pam_ldap.c:1947
1947      rc = ldap_search_s (session->ld,
(gdb) p session->ld->ld_matched
$19 = 0x0
(gdb) fr 5
#5  0xef52bf04 in ldap_search_s (ld=0x2dec8,
    base=0x294a0 "ou=People,dc=sgh,dc=waw,dc=pl", scope=2,
    filter=0xeffff770 "(uid=chopin)", attrs=0x0, attrsonly=0, res=0xeffff36c)
    at search.c:954
954             return( ldap_result2error( ld, *res, 0 ) );
(gdb) p ld->ld_matched
$20 = 0x1 <Address 0x1 out of bounds>

So rather looks like this happened in openldap, not pam_ldap.

Anyway I'm now stuck, not really know what to do.

p.