ldapsearch strlen SIGSEGV on Solaris (ITS#2248)

[mzubcic@zesoi.fer.hr]

Full_Name: Miroslav Zubcic
Version: 2.1.9
OS: SunOS zvijer 5.8 Generic_108528-13 sun4u sparc SUNW,Ultra-Enterprise
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (213.202.124.154)


Something has shenged in clients/tools/ldapsearch.c between 2.1.8 and 2.1.9
and now 64bit ldapsearch is coredumping on my Ultra machine *if* I don't
specify
-L(LL) options.

I'm not C programmer, but if I comment out this part in ldapsearch.c and
recompile ldapsearch(1), everything is OK:

		printf( "#\n"
			"# LDAPv%d\n"
			"# base <%s> with scope %s\n"
			"# filter%s: %s\n"
			"# requesting: ",
			version,
			base, (scope == LDAP_SCOPE_BASE) ? "base"
				: ((scope == LDAP_SCOPE_ONELEVEL) ? "one" : "sub"),
			infile != NULL ? " pattern" : "",
			filtpattern );

This is difference between 2.1.8 (`-') and 2.1.9 (`+') ldapsearch.c code:
        if (ldif < 2 ) {
-               printf( "#\n# LDAPv%d\n# filter%s: %s\n# requesting: ",
+               printf( "#\n"
+                       "# LDAPv%d\n"
+                       "# base <%s> with scope %s\n"
+                       "# filter%s: %s\n"
+                       "# requesting: ",
                        version,
+                       base, (scope == LDAP_SCOPE_BASE) ? "base"
+                               : ((scope == LDAP_SCOPE_ONELEVEL) ? "one" :
"sub"),
                        infile != NULL ? " pattern" : "",
                        filtpattern );


Below is actual backtrace FYI:
-----------------------------------------------
(root){lav}[tools]# mdb core
Loading modules: [ ]
> ::status
debugging core file of ldapsearch (64-bit) from lav
executable file: /usr/local/src/openldap-2.1.9/clients/tools/ldapsearch
initial argv: ./ldapsearch -x
status: SIGSEGV (Segmentation Fault)

> ::stack
libc.so.1`strlen+0x38(0, 100083af3, 73, 100197a70, 0, 0)
libc.so.1`printf+0xfc(0, 1001979f0, ffffffff7e0c0d08, 100083758, 100083080, 2)
main+0x4598(2, ffffffff7ffff5b8, ffffffff7ffff5d0, 100197760, 100000000, 0)
_start+0x7c(0, 0, 0, 0, 0, 0)

> $?
no process
SIGSEGV: Segmentation Fault
%g0 = 0x0000000000000000                 %l0 = 0x0000000000000000 
%g1 = 0x00000001000830b8                 %l1 = 0x00000001000830bf 
%g2 = 0x0000000000000000                 %l2 = 0x0000000000000000 
%g3 = 0x0000000000000000                 %l3 = 0x0000000100083af4 
%g4 = 0xffffffff7fffeee0                 %l4 = 0x0000000100197771
ldapsearch`_sasl_verify_password+0x29
%g5 = 0x0000000000001988                 %l5 = 0x0000000000000002 
%g6 = 0x0000000000000000                 %l6 = 0x0000000000000001 
%g7 = 0x0000000000000000                 %l7 = 0xffffffff7e0b2f60 

%o0 = 0x0000000000000000                 %i0 = 0x0000000000000000 
%o1 = 0x0000000000000002                 %i1 = 0x0000000100083af3 
%o2 = 0x0000000000000002                 %i2 = 0x0000000000000073 
%o3 = 0x0000000000000002                 %i3 = 0x0000000100197a70
ldapsearch`_ctype+0x200
%o4 = 0x000000000000005a                 %i4 = 0x0000000000000000 
%o5 = 0xffffffff7e0c0404 libc.so.1`_sobuf+0x3c %i5 = 0x0000000000000000 
%o6 = 0xffffffff7fffd601                 %i6 = 0xffffffff7fffe581 
%o7 = 0xffffffff7df8be0c libc.so.1`_doprnt+0x1948 %i7 = 0xffffffff7df8da48
libc.so.1`printf+0xfc

 %ccr = 0x99 xcc=NzvC icc=NzvC
   %y = 0x0000000000000000
  %pc = 0xffffffff7df3c198 libc.so.1`strlen+0x38
 %npc = 0xffffffff7df3c19c libc.so.1`strlen+0x3c
  %sp = 0xffffffff7fffd601
  %fp = 0xffffffff7fffe581

 %asi = 0x82
%fprs = 0x07
> 
-------------------------------------------------------------------

Hope this helps.

-- 
Miroslav