(ITS#4499) Crash in slap_send_ldap_result() with back-ldif

[h.b.furuseth@usit.uio.no]

Full_Name: Hallvard B Furuseth
Version: HEAD
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (129.240.186.42)
Submitted by: hallvard


cd tests; ./run -b ldif test014-whoami

Testing ldapwhoami as cn=Bjorn Jensen,ou=Information Technology
Division,ou=People,dc=example,dc=com for u:group/itd staff (dn.subtree)...
dn:cn=itd staff,ou=groups,dc=example,dc=com
Testing ldapwhoami as cn=Bjorn Jensen,ou=Information Technology
Division,ou=People,dc=example,dc=com for u:fail (URI; should fail)...
ldap_result: Can't contact LDAP server (-1)
./scripts/test014-whoami: line 388: 15574 Aborted                 (core dumped)
$SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING >$LOG1 2>&1

testrun/slapd.1.log ends with:
<<< dnNormalize: <cn=manager,dc=example,dc=com>
>>> dnNormalize: <cn=Manager,dc=example,dc=com>
=> ldap_bv2dn(cn=Manager,dc=example,dc=com,0)
<= ldap_bv2dn(cn=Manager,dc=example,dc=com)=0 
=> ldap_dn2bv(272)
<= ldap_dn2bv(cn=manager,dc=example,dc=com)=0 
<<< dnNormalize: <cn=manager,dc=example,dc=com>
<= str2entry(cn=Should Fail) -> 0x832dda8
slap_sc_sasl2dn: search DN returned more than 1 entry
slapd: result.c:640: slap_send_ldap_result: Assertion `!LDAP_API_ERROR(
rs->sr_err )' failed.

Backtrace:
(gdb) bt
#0  0x0014f7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x0018f7f5 in raise () from /lib/tls/libc.so.6
#2  0x00191199 in abort () from /lib/tls/libc.so.6
#3  0x00188dd1 in __assert_fail () from /lib/tls/libc.so.6
#4  0x0808850b in slap_send_ldap_result (op=0xb7260edc, rs=0xb7260ea0)
    at result.c:640
#5  0x080f82af in ldif_back_search (op=0xb7260edc, rs=0xb7260ea0) at ldif.c:766
#6  0x080bbd74 in slap_sasl2dn (opx=0x832d3d0, saslname=0xb72610d4, 
    sasldn=0xb7261084, flags=0) at saslauthz.c:2003
#7  0x080c1f8a in slap_sasl_getdn (conn=0x82bf300, op=0x832d3d0, 
    id=0xb6d60020, user_realm=0x0, dn=0xb72610d4, flags=Variable "flags" is not
available.
) at sasl.c:1776
#8  0x080a7b68 in parseProxyAuthz (op=0x832d3d0, rs=0xb7261210, 
    ctrl=0xb6d6001c) at controls.c:966
#9  0x080a6e8a in slap_parse_ctrl (op=0x832d3d0, rs=0x0, control=0xb6d6001c, 
    text=0xb7261224) at controls.c:585
#10 0x080a74e5 in get_ctrls (op=0x832d3d0, rs=0xb7261210, sendres=1)
    at controls.c:754
#11 0x080a8c69 in do_extended (op=0x832d3d0, rs=0xb7261210) at extended.c:157
#12 0x08079c5c in connection_operation (ctx=0xb72612bc, arg_v=0x832d3d0)
    at connection.c:1354
#13 0x0807a033 in connection_read_thread (ctx=0xb72612bc, argv=0x8)
    at connection.c:1481
#14 0x08150ab4 in ldap_int_thread_pool_wrapper (xpool=0x8245220) at tpool.c:613
#15 0x003c7371 in start_thread () from /lib/tls/libpthread.so.0
#16 0x0022f9be in clone () from /lib/tls/libc.so.6
(gdb) frame 4
#4  0x0808850b in slap_send_ldap_result (op=0xb7260edc, rs=0xb7260ea0)
    at result.c:640
640             assert( !LDAP_API_ERROR( rs->sr_err ) );
(gdb) p rs->sr_err
$1 = -1
(gdb) p *rs
$2 = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = -1, 
  sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {
    sru_sasl = {r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, 
      r_rspdata = 0x0}, sru_search = {r_entry = 0x0, r_attr_flags = 0, 
      r_operational_attrs = 0x0, r_attrs = 0x81f9a00, r_nentries = 0, 
      r_v2ref = 0x0}}, sr_flags = 1}
(gdb) up
#5  0x080f82af in ldif_back_search (op=0xb7260edc, rs=0xb7260ea0) at ldif.c:766
766             send_ldap_result(op, rs);
(gdb) p ck
$4 = {op = 0xb7260edc, rs = 0xb7260ea0, entries = 0x0, elen = 0, eind = 0}