RE: slapadd segfaults (ITS#2587)

[hyc@highlandsun.com]

The ldap_dnfree code etc. hasn't changed since release 2.1.14, so the problem
won't show up tracing this part of the code. In your stack trace the pointers
passed to ldap_rdnfree and ldap_avafree are bogus, so the DN's pointers got
corrupted somewhere else. Can you debug this using something like
ElectricFence, that may help to pinpoint the problem.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support

> -----Original Message-----
> From: owner-openldap-bugs@OpenLDAP.org
> [mailto:owner-openldap-bugs@OpenLDAP.org]On Behalf Of
> pturgyan@umich.edu
> Sent: Tuesday, June 10, 2003 7:49 AM
> To: openldap-its@OpenLDAP.org
> Subject: slapadd segfaults (ITS#2587)
>
>
> Full_Name: Paul R. Turgyan
> Version: 2.1.19
> OS: linux
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (141.213.231.21)
>
>
> slapadd Versions 2.1.19, 2.1.20, & 2.1.21 segfaults.
> Here is a stack trace:
>
> Program received signal SIGSEGV, Segmentation fault.
> __libc_free (mem=0x3e132d) at malloc.c:3135
> 3135      if (chunk_is_mmapped(p))                /* release
> mmapped memory. */
> (gdb)  bt
> #0  __libc_free (mem=0x3e132d) at malloc.c:3135
> #1  0x080bc0bb in ldap_avafree (ava=0x4018f618) at getdn.c:623
> #2  0x080bc123 in ldap_rdnfree (rdn=0x3e1325) at getdn.c:638
> #3  0x080bc173 in ldap_dnfree (dn=0x8316568) at getdn.c:654
> #4  0x0806ffb5 in dnPretty2 (syntax=0x82ad138,
> val=0xbffff940, out=0xbffff928)
>     at dn.c:485
> #5  0x0806e115 in str2entry (
>     s=0x832f95b "creatorsname: uid=vtrista, ou=People,
> dc=umich, dc=edu")
>     at entry.c:190
> #6  0x0804b65e in main (argc=6, argv=0xbffffc14) at slapadd.c:62
> #7  0x40088552 in __libc_start_main (main=0x804b4f8 <main>, argc=6,
>     ubp_av=0xbffffc14, init=0x804a75c <_init>,
>     fini=0x400157ec <_dl_debug_mask>, rtld_fini=0, stack_end=0x3e132d)
>     at ../sysdeps/generic/libc-start.c:129
> (gdb)
>
> While stepping through the code,  it looked like ldap_dnfree
> was executing the "free" loop one too many times.
>
>
> Earlier slapadd versions 2.1.17 & 2.1.18 work great.
>
>
> The entry that causes this crash to happen, looks normal,
> and the entry will load if it's in a ldif all by itself.
> The entry is about the 26000th in the failing ldif.
>
>
> machine type: 686
> os:           linux - kernal version: 2.4.20
> compiler:     gcc 3.2.3
>
> backend:      bdb -- Berkeley 4.1.25
>
> DB_CONFIG
> set_lk_max_locks 2500
> set_lk_max_objects 2500
> #
> set_cachesize 0 500000000 1
> #
> # For database loading we want NO SYNC to Disk.
> set_flags DB_TXN_NOSYNC
>
> # Set transaction log buffer size to 2 megs
> set_lg_bsize 2097152
>
>
>
>