(ITS#5124) segfault on modify operation by slurpd with rwm overlay

[jclarke@linagora.com]

Full_Name: Jonathan Clarke
Version: 2.3.37
OS: Debian Etch
URL: ftp://ftp.openldap.org/incoming/jclarke-slurpd-rwm-modify-bug.tar.gz
Submission from: (NULL) (134.157.159.100)


Hello guys,

With a simple master/slave setup, and the rwm overlay activated for the bindDN
context, any modify operation made on the master, replicated with slurpd causes
the slave to crash.

You will find below a backtrace of the slave when it crashes, and the
configuration files we're using on the master, the slave, an LDIF of the
contents of the directory are in the archive on ftp.openldap.org indicated in
the ITS.

We are using 2.3.37 for both master and slave, and have confirmed that
disactivating the rwm overlay in slapd.conf avoids the problem.

Thanks in advance for your help !
Jon

***** BACKTRACE ******
conn=0 fd=14 ACCEPT from IP=127.0.0.1:57752 (IP=0.0.0.0:392)
[New Thread 32771 (LWP 21187)]
conn=0 op=0 BIND dn="uid=replicator,dc=linagora,dc=org" method=128
conn=0 op=0 BIND dn="uid=replicator,dc=linagora,dc=org" mech=SIMPLE ssf=0
conn=0 op=0 RESULT tag=97 err=0 text=
conn=0 op=1 MOD dn="dc=linagora,dc=org"
conn=0 op=1 MOD attr=description entryCSN modifiersName modifyTimestamp
conn=0 op=1 RESULT tag=103 err=0 text=

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 32771 (LWP 21187)]
0x4035dafb in free () from /lib/libc.so.6

(gdb) bt
#0  0x4035dafb in free () from /lib/libc.so.6
#1  0x4035f805 in malloc () from /lib/libc.so.6
#2  0x0813e70f in ber_memalloc_x (s=1, ctx=0x40412660) at memory.c:226
#3  0x08079fa8 in ch_malloc (size=16) at ch_malloc.c:54
#4  0x08101567 in rwm_op_modify (op=0x8246fc0, rs=0x6301dce4) at rwm.c:590
#5  0x080b6c5e in overlay_op_walk (op=0x8246fc0, rs=0x6301dce4, which=op_modify,
oi=0x81e9688, on=0x81e9778) at backover.c:639
#6  0x080b70ce in over_op_func (op=0x8246fc0, rs=0x6301dce4, which=op_modify) at
backover.c:701
#7  0x08077e00 in do_modify (op=0x8246fc0, rs=0x6301dce4) at modify.c:200
#8  0x080609bb in connection_operation (ctx=0x6301dd58, arg_v=0x8246fc0) at
connection.c:1133
#9  0x0811a8b4 in ldap_int_thread_pool_wrapper (xpool=0x81d0000) at tpool.c:478
#10 0x402adc51 in pthread_start_thread () from /lib/libpthread.so.0
#11 0x402addb4 in pthread_start_thread_event () from /lib/libpthread.so.0
#12 0x403b438a in clone () from /lib/libc.so.6

***** End of backtrace  *****