segfaults with 2.0.27 (ITS#2167)

[jwm@horde.net]

Full_Name: John Morrissey
Version: 2.0.27
OS: Linux
URL: 
Submission from: (NULL) (24.93.15.178)


After upgrading three machines from 2.0.25 to 2.0.27, I experienced
segfaults in slapd after a few hours of uptime. slapindex segfaulted after
about twenty minutes' runtime. Moving back to 2.0.25 immediately cured
things.

A couple backtraces from slapindex:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 3964)]
0x4207adb0 in chunk_free () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4207adb0 in chunk_free () from /lib/i686/libc.so.6
#1  0x4207ad14 in free () from /lib/i686/libc.so.6
#2  0x40049eed in ber_memfree () from /usr/lib/liblber.so.2
#3  0x0808299e in ldif_parse_line (
    line=0x1de80e07 "serviceType: xxxxxxxxxxxxxxxxxxxxxxxxxx",
    typep=0xbffff938, valuep=0xbffff934, vlenp=0xbffff930) at line64.c:239
#4  0x0806466f in str2entry (
    s=0x1de80e07 "serviceType: xxxxxxxxxxxxxxxxxxxxxxxxxx") at entry.c:92
#5  0x080704ef in ldbm_tool_entry_get (be=0x80c0e50, id=482042) at
tools.c:137
#6  0x08070825 in ldbm_tool_entry_reindex (be=0x80c0e50, id=482042)
    at tools.c:220
#7  0x0804b7f3 in main (argc=1, argv=0xbffffa54) at slapindex.c:54
#8  0x42017589 in __libc_start_main () from /lib/i686/libc.so.6


(gdb) bt
#0  0x4207abe7 in chunk_alloc () from /lib/i686/libc.so.6
#1  0x4207a148 in malloc () from /lib/i686/libc.so.6
#2  0x4005e609 in _gdbm_read_entry () from /usr/lib/libgdbm.so.2
#3  0x4005e848 in _gdbm_findkey () from /usr/lib/libgdbm.so.2
#4  0x4005c6a1 in gdbm_fetch () from /usr/lib/libgdbm.so.2
#5  0x08083810 in ldbm_fetch (ldbm=0x1401b9d0, key=
      {dptr = 0x1f873800 ".�", dsize = 21}) at ldbm.c:656
#6  0x08077ce5 in ldbm_cache_fetch (db=0x80c13ac, key=
      {dptr = 0x1f873800 ".�", dsize = 21}) at dbcache.c:329
#7  0x0807ca59 in idl_fetch_one (be=0x80c0e50, db=0x80c13ac, key=
      {dptr = 0x1f873800 ".�", dsize = 21}) at idl.c:138
#8  0x0807d520 in idl_insert_key (be=0x80c0e50, db=0x80c13ac, key=
      {dptr = 0x22710290 "\022\202v r\234mp\2012w\2157'\0341", dsize = 16},
    id=431363) at idl.c:495
#9  0x0807f623 in key_change (be=0x80c0e50, db=0x80c13ac, k=0x22120cd8, 
    id=431363, op=1) at key.c:68
#10 0x0807f048 in indexer (be=0x80c0e50, dbname=0x80a4148 "telephoneNumber", 
    atname=0x80a4148 "telephoneNumber", vals=0x1df60b70, id=431363, op=1,
    mask=532) at index.c:212
#11 0x0807f145 in index_at_values (be=0x80c0e50, type=0x80a41e0, lang=0x0, 
    vals=0x1df60b70, id=431363, op=1, dbnamep=0xbffff6f4, maskp=0xbffff6f0)
    at index.c:254
#12 0x0807f285 in index_values (be=0x80c0e50, desc=0x1c6aaa08,
vals=0x1df60b70,
    id=431363, op=1) at index.c:304
#13 0x0807f362 in index_entry (be=0x80c0e50, op=1, e=0x22558938,
ap=0x1e0fd420)
    at index.c:329
#14 0x08070913 in ldbm_tool_entry_reindex (be=0x80c0e50, id=431363)
    at tools.c:240
#15 0x0804b7f3 in main (argc=1, argv=0xbffff804) at slapindex.c:54
#16 0x42017589 in __libc_start_main () from /lib/i686/libc.so.6