(ITS#4932) Core dump caused in ldap_extended_operation()

[rguerrero@datamirror.com]

Full_Name: Ron Guerrero
Version: 2.3.27
OS: AIX 5.3
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (64.201.167.139)


We've got an application that indirectly calls OpenLDAP APIs.  One function in
particular is causing our process to core dump.  The stack trace generated by
dbx is as follows:

0xd0128470 (pthread_kill+0x88) 80410014        lwz   r2,0x14(r1)
pthread_kill(??, ??) at 0xd0128470
_p_raise(??) at 0xd0127f08
raise.raise(??) at 0xd0315740
abort.abort() at 0xd0344cb0
__assert_c99(??, ??, ??, ??) at 0xd03aede0
ldap_extended_operation(ld = (nil), reqoid = "1.3.6.1.4.1.1466.20037", reqdata =
(nil), sctrls = (nil), cctrls = ??, msgidp = 0x2ff18cd4), line 62 in
"extended.c"
ldap_start_tls(ld = ??, serverctrls = ??, clientctrls = ??, msgidp = ??), line
1859 in "tls.c"
do_start_tls(session = 0xf027b7f0), line 1343 in "ldap-nss.c"
unnamed block in do_with_reconnect(base = "dc=gwl,dc=com", scope = 2, filter =
"(&(objectClass=posixAccount)(uidNumber=138056))", attrs = 0xf027d5a8, sizelimit
= 1, private = 0x2ff19658, search_func = 0xf027b9a0), line 1530 in "ldap-nss.c"
unnamed block in do_with_reconnect(base = "dc=gwl,dc=com", scope = 2, filter =
"(&(objectClass=posixAccount)(uidNumber=138056))", attrs = 0xf027d5a8, sizelimit
= 1, private = 0x2ff19658, search_func = 0xf027b9a0), line 1530 in "ldap-nss.c"
unnamed block in do_with_reconnect(base = "dc=gwl,dc=com", scope = 2, filter =
"(&(objectClass=posixAccount)(uidNumber=138056))", attrs = 0xf027d5a8, sizelimit
= 1, private = 0x2ff19658, search_func = 0xf027b9a0), line 1530 in "ldap-nss.c"
do_with_reconnect(base = "dc=gwl,dc=com", scope = 2, filter =
"(&(objectClass=posixAccount)(uidNumber=138056))", attrs = 0xf027d5a8, sizelimit
= 1, private = 0x2ff19658, search_func = 0xf027b9a0), line 1530 in "ldap-nss.c"
_nss_ldap_search_s(args = 0x2ff196c8, filterprot =
"(&(objectClass=posixAccount)(uidNumber=%d))", sel = LM_PASSWD, user_attrs =
(nil), sizelimit = 1, res = 0x2ff19658), line 3047 in "ldap-nss.c"
_nss_ldap_getbyname(args = 0x2ff196c8, result = 0x20131698, buffer = "", buflen
= 1024, errnop = 0x2ff22ff8, filterprot =
"(&(objectClass=posixAccount)(uidNumber=%d))", sel = LM_PASSWD, parser =
0xf027b97c), line 3394 in "ldap-nss.c"
ldap-pwd.pw_byuid(this = ??, uid = ??), line 55 in "irs-pwd.c"
_nss_ldap_getpwuid(uid = 138056), line 181 in "aix_authmeth.c"
_getpwuid_shadow_r(??, ??, ??, ??, ??) at 0xd03d0900
_posix_getpwuid_shadow_r(??, ??, ??, ??, ??, ??) at 0xd03d02cc
sniq.getpwuid_r(??, ??, ??, ??, ??) at 0xd249170c
snigun(??, ??, ??) at 0xd2491648
nigconcbs(??, ??, ??) at 0xd28cc858
osncon(0x0, 0x0, 0x1803, 0x201090ec, 0x20105bec, 0x20105be4, 0x20105b70,
0x20105c20) at 0xd28cce6c
kpuadef(??, ??, ??, ??, ??, ??, ??, ??) at 0xd1d0d1b4
upiini(0x0, 0x0, 0x0, 0x0, 0x200eda80, 0x200edca0, 0x200edef4, 0x2010fe40) at
0xd20f24d4
upiah0(??, ??, ??, ??, ??, ??, ??) at 0xd20efce4
kpuatch(??, ??, ??, ??, ??, ??, ??) at 0xd1d378fc
OCIServerAttach(??, ??, ??, ??, ??) at 0xd20fbfb0

As you can see application makes a call to an Oracle API. 

Has anyone seen this issue before?  Notice in ldap_start_tls() the first
parameter, the ldap handle, is non-null. However, in ldap_extended_operation(),
the ldap handle is null. Looking at the code, ldap_start_tls() is calling
ldap_extended_operation() with the same ldap handle that was passed to it.

The latest source files for extended.c and tls.c have not changed since the
2.3.27 release.