slapadd segfaults (ITS#2587)

[pturgyan@umich.edu]

Full_Name: Paul R. Turgyan
Version: 2.1.19
OS: linux 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (141.213.231.21)


slapadd Versions 2.1.19, 2.1.20, & 2.1.21 segfaults.
Here is a stack trace:

Program received signal SIGSEGV, Segmentation fault.
__libc_free (mem=0x3e132d) at malloc.c:3135
3135      if (chunk_is_mmapped(p))                /* release mmapped memory. */
(gdb)  bt
#0  __libc_free (mem=0x3e132d) at malloc.c:3135
#1  0x080bc0bb in ldap_avafree (ava=0x4018f618) at getdn.c:623
#2  0x080bc123 in ldap_rdnfree (rdn=0x3e1325) at getdn.c:638
#3  0x080bc173 in ldap_dnfree (dn=0x8316568) at getdn.c:654
#4  0x0806ffb5 in dnPretty2 (syntax=0x82ad138, val=0xbffff940, out=0xbffff928)
    at dn.c:485
#5  0x0806e115 in str2entry (
    s=0x832f95b "creatorsname: uid=vtrista, ou=People, dc=umich, dc=edu")
    at entry.c:190
#6  0x0804b65e in main (argc=6, argv=0xbffffc14) at slapadd.c:62
#7  0x40088552 in __libc_start_main (main=0x804b4f8 <main>, argc=6,
    ubp_av=0xbffffc14, init=0x804a75c <_init>,
    fini=0x400157ec <_dl_debug_mask>, rtld_fini=0, stack_end=0x3e132d)
    at ../sysdeps/generic/libc-start.c:129
(gdb)

While stepping through the code,  it looked like ldap_dnfree
was executing the "free" loop one too many times.


Earlier slapadd versions 2.1.17 & 2.1.18 work great.


The entry that causes this crash to happen, looks normal,
and the entry will load if it's in a ldif all by itself. 
The entry is about the 26000th in the failing ldif.

 
machine type: 686
os:           linux - kernal version: 2.4.20
compiler:     gcc 3.2.3

backend:      bdb -- Berkeley 4.1.25

DB_CONFIG 
set_lk_max_locks 2500
set_lk_max_objects 2500
#
set_cachesize 0 500000000 1 
#
# For database loading we want NO SYNC to Disk.
set_flags DB_TXN_NOSYNC

# Set transaction log buffer size to 2 megs
set_lg_bsize 2097152