Slapd SIGSEGV during ldapsearch -Y gssapi (ITS#2101)

[mvz@hac.hr]

Full_Name: Miroslav Zubcic
Version: 2.1.5
OS: Linux 2.4.18 glibc 2.2.5
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (194.152.228.20)


This can happen when slapd(8) is under heavy load (3-4 simultaneous
connections)
- not always, sometimes I can search "(objectClass=*)" without segmentation
fault.
Cyrus-sasl 2.1.7
MIT Kerberos 1.2.5

Here is a trace:

---------------------------------------------------------------------
(root){anthea}[ldap]# gdb /usr/local/test/libexec/slapd core.5077
GNU gdb Red Hat Linux (5.1.90CVS-5)
Core was generated by `/usr/local/test/libexec/slapd -4 -h ldap://127.0.0.1
ldaps://127.0.0.1 ldap://1'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/libresolv.so.2
Reading symbols from /usr/local/test/lib/libsasl2.so.2...done.
Loaded symbols for /usr/local/test/lib/libsasl2.so.2
Reading symbols from /opt/kerberos/lib/libkrb4.so.2...done.
Loaded symbols for /opt/kerberos/lib/libkrb4.so.2
Reading symbols from /opt/kerberos/lib/libdes425.so.3...done.
Loaded symbols for /opt/kerberos/lib/libdes425.so.3
Reading symbols from /opt/kerberos/lib/libkrb5.so.3...done.
Loaded symbols for /opt/kerberos/lib/libkrb5.so.3
Reading symbols from /opt/kerberos/lib/libk5crypto.so.3...done.
Loaded symbols for /opt/kerberos/lib/libk5crypto.so.3
Reading symbols from /opt/kerberos/lib/libcom_err.so.3...done.
Loaded symbols for /opt/kerberos/lib/libcom_err.so.3
Reading symbols from /lib/libssl.so.2...done.
Loaded symbols for /lib/libssl.so.2
Reading symbols from /lib/libcrypto.so.2...done.
Loaded symbols for /lib/libcrypto.so.2
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libpthread.so.0...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /usr/local/test/lib/sasl2/libsasldb.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libsasldb.so.2
Reading symbols from /usr/local/test/lib/sasl2/libcrammd5.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libcrammd5.so.2
Reading symbols from /usr/local/test/lib/sasl2/libdigestmd5.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libdigestmd5.so.2
Reading symbols from /usr/local/test/lib/sasl2/libotp.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libotp.so.2
Reading symbols from /usr/local/test/lib/sasl2/libgssapiv2.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libgssapiv2.so.2
Reading symbols from /opt/kerberos/lib/libgssapi_krb5.so.2...done.
Loaded symbols for /opt/kerberos/lib/libgssapi_krb5.so.2
Reading symbols from /lib/libcom_err.so.2...done.
Loaded symbols for /lib/libcom_err.so.2
Reading symbols from /usr/lib/libdb.so.3...done.
Loaded symbols for /usr/lib/libdb.so.3
Reading symbols from /usr/local/test/lib/sasl2/libplain.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libplain.so.2
Reading symbols from /usr/local/test/lib/sasl2/libanonymous.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/libanonymous.so.2
Reading symbols from /usr/local/test/lib/sasl2/liblogin.so.2...done.
Loaded symbols for /usr/local/test/lib/sasl2/liblogin.so.2
Reading symbols from /lib/libnss_dns.so.2...done.
Loaded symbols for /lib/libnss_dns.so.2
#0  0x40298987 in memcpy () from /lib/libc.so.6
(gdb) bt
#0  0x40298987 in memcpy () from /lib/libc.so.6
#1  0x400c973b in krb5_c_random_make_octets () from
/opt/kerberos/lib/libk5crypto.so.3
#2  0x4047a437 in kg_make_confounder () from
/opt/kerberos/lib/libgssapi_krb5.so.2
#3  0x40477434 in make_seal_token_v1 () from
/opt/kerberos/lib/libgssapi_krb5.so.2
#4  0x40477933 in kg_seal () from /opt/kerberos/lib/libgssapi_krb5.so.2
#5  0x404791eb in krb5_gss_wrap () from /opt/kerberos/lib/libgssapi_krb5.so.2
#6  0x40478b53 in gss_wrap () from /opt/kerberos/lib/libgssapi_krb5.so.2
#7  0x4002250a in sasl_gss_encode (context=0x83c2308, invec=0xbf5ff38c,
numiov=1, output=0x83c370c, outputlen=0x83c3700, privacy=1) at gssapi.c:283
#8  0x40022614 in gssapi_privacy_encode (context=0x83c2308, invec=0xbf5ff38c,
numiov=1, output=0x83c370c, outputlen=0x83c3700) at gssapi.c:331
#9  0x40043583 in sasl_encodev (conn=0x83c16a0, invec=0xbf5ff38c, numiov=1,
output=0x83c370c, outputlen=0x83c3700) at common.c:234
#10 0x40043443 in sasl_encode (conn=0x83c16a0, input=0x83c43c0 "", inputlen=173,
output=0x83c370c, outputlen=0x83c3700) at common.c:191
#11 0x080c14e4 in strcpy ()
#12 0x080dbc9e in strcpy ()
#13 0x080db4ad in strcpy ()
#14 0x080d90af in strcpy ()
#15 0x0805e9b6 in strcpy ()
#16 0x080604b2 in strcpy ()
#17 0x0808c5c1 in strcpy ()
#18 0x08053c2b in strcpy ()
#19 0x0805246e in strcpy ()
#20 0x080bda0c in strcpy ()
#21 0x4020cf77 in pthread_start_thread () from /lib/libpthread.so.0

Hope this helps ...

-- 
Miroslav Zubcic