"unknown filter type" followed by SEGV (ITS#3300)

[richton@nbcs.rutgers.edu]

Full_Name: Aaron Richton
Version: 2.2.15
OS: Solaris 9
URL: 
Submission from: (NULL) (165.230.41.99)


OpenLDAP 2.2.15, BDB 4.2.52+2 patches, HDB databases, Cyrus SASL 2.1.18,
OpenSSL
0.9.7d.

The following messages were output to syslog:

unknown filter type 13961616
unknown filter type 4209846818

and then slapd seg faulted.

gdb "thr apply all bt":

Thread 8 (process 286791    ):
#0  0xfedd58fc in __lwp_park () from /usr/lib/libthread.so.1
#1  0xfedd2ba8 in cond_wait_queue () from /usr/lib/libthread.so.1
#2  0xfedd3364 in cond_wait () from /usr/lib/libthread.so.1
#3  0xfedd33a0 in pthread_cond_wait () from /usr/lib/libthread.so.1
#4  0x00181098 in ldap_pvt_thread_cond_wait (cond=0x3394d0, mutex=0x3394b8)
    at thr_posix.c:251
#5  0x0017faec in ldap_int_thread_pool_wrapper (xpool=0x3394b0) at tpool.c:456

Thread 7 (process 221255    ):
#0  0x0010f5e8 in hdb_do_search () at tools.c:288
#1  0x0010c524 in hdb_search () at tools.c:288
#2  0x00079958 in do_search (op=0x609c770, rs=0xda3ffd58) at search.c:412
#3  0x00075e7c in connection_operation (ctx=0xda3ffe14, arg_v=0x609c770)
    at connection.c:1073
#4  0x0017fb68 in ldap_int_thread_pool_wrapper (xpool=0x3394b0) at tpool.c:467

Thread 6 (process 155719    ):
#0  0xfee9d608 in _poll () from /usr/lib/libc.so.1
#1  0xfee51e78 in _select () from /usr/lib/libc.so.1
#2  0xfedce6b4 in select () from /usr/lib/libthread.so.1
#3  0x00070b38 in slapd_daemon_task (ptr=0x0) at daemon.c:1422

Thread 5 (process 90183    ):
#0  0xfee9f334 in _lwp_wait () from /usr/lib/libc.so.1
#1  0xfedcd6bc in lwp_wait () from /usr/lib/libthread.so.1
#2  0xfedc90f0 in _thrp_join () from /usr/lib/libthread.so.1
#3  0x00180e98 in ldap_pvt_thread_join (thread=2, thread_return=0x0)
    at thr_posix.c:151
#4  0x00072664 in slapd_daemon () at daemon.c:2032
#5  0x00060bec in main (argc=4, argv=0xffbffd94) at main.c:710

Thread 4 (process 548935    ):
#0  0xfedd58fc in __lwp_park () from /usr/lib/libthread.so.1
#1  0xfedd2ba8 in cond_wait_queue () from /usr/lib/libthread.so.1
#2  0xfedd3364 in cond_wait () from /usr/lib/libthread.so.1
#3  0xfedd33a0 in pthread_cond_wait () from /usr/lib/libthread.so.1
#4  0x00181098 in ldap_pvt_thread_cond_wait (cond=0x3394d0, mutex=0x3394b8)
    at thr_posix.c:251
#5  0x0017faec in ldap_int_thread_pool_wrapper (xpool=0x3394b0) at tpool.c:456

Thread 3 (process 483399    ):
#0  0xff2ecd1c in __db_c_close () from /usr/local/lib/libdb-4.2.so
#1  0xff2f56c0 in __db_get () from /usr/local/lib/libdb-4.2.so
#2  0xff2f55ac in __db_get_pp () from /usr/local/lib/libdb-4.2.so
#3  0x0014a36c in hdb_id2entry (be=0x381660, tid=0xd2f3d0, id=1920,
    e=0xd833f734) at id2entry.c:111
#4  0x0013e1e8 in hdb_cache_find_id (op=0x6a4d820, tid=0x0, id=1920,
    eip=0xd833f968, islocked=0, locker=88, lock=0xd833f7fc) at cache.c:700
#5  0x0010e98c in hdb_do_search () at tools.c:288
#6  0x0010c524 in hdb_search () at tools.c:288
#7  0x00079958 in do_search (op=0x6a4d820, rs=0xd83ffd58) at search.c:412
#8  0x00075e7c in connection_operation (ctx=0xd83ffe14, arg_v=0x6a4d820)
    at connection.c:1073
#9  0x0017fb68 in ldap_int_thread_pool_wrapper (xpool=0x3394b0) at tpool.c:467

Thread 2 (process 417863    ):
#0  0xff3188d8 in __lock_put_internal () from /usr/local/lib/libdb-4.2.so
#1  0xff318340 in __lock_put_nolock () from /usr/local/lib/libdb-4.2.so
#2  0xff31824c in __lock_put () from /usr/local/lib/libdb-4.2.so
#3  0xff3181cc in __lock_put_pp () from /usr/local/lib/libdb-4.2.so
#4  0x0013ccb8 in hdb_cache_entry_db_unlock () at cache.c:156
#5  0x0013dc00 in bdb_cache_lru_add () at index.c:324
#6  0x0013e5d4 in hdb_cache_find_id (op=0x3281618, tid=0x0, id=1605,
    eip=0xd8b3f968, islocked=0, locker=61, lock=0xd8b3f7fc) at cache.c:775
#7  0x0010e98c in hdb_do_search () at tools.c:288
#8  0x0010c524 in hdb_search () at tools.c:288
#9  0x00079958 in do_search (op=0x3281618, rs=0xd8bffd58) at search.c:412
#10 0x00075e7c in connection_operation (ctx=0xd8bffe14, arg_v=0x3281618)
    at connection.c:1073
#11 0x0017fb68 in ldap_int_thread_pool_wrapper (xpool=0x3394b0) at tpool.c:467

Thread 1 (process 352327    ):
#0  0x0009dff8 in test_filter (op=0x68b73c0, e=0x6894368, f=0x989dbbe4)
    at filterentry.c:67
#1  0x0009f074 in test_filter_and (op=0x68b73c0, e=0x6894368, flist=0xd933f8e8)
    at filterentry.c:544
#2  0x0009dd00 in test_filter (op=0x68b73c0, e=0x6894368, f=0xd933f8f4)
    at filterentry.c:139
#3  0x0010f470 in hdb_do_search () at tools.c:288
#4  0x0010c524 in hdb_search () at tools.c:288
#5  0x00079958 in do_search (op=0x68b73c0, rs=0xd93ffd58) at search.c:412
#6  0x00075e7c in connection_operation (ctx=0xd93ffe14, arg_v=0x68b73c0)
    at connection.c:1073
#7  0x0017fb68 in ldap_int_thread_pool_wrapper (xpool=0x3394b0) at tpool.c:467