(ITS#5452) seg fault in syncprov_op abandon on master

[quanah@zimbra.com]

Full_Name: Quanah Gibson-Mount
Version: 2.3.41
OS: Linux 2.6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (24.23.156.219)


Core was generated by `/opt/zimbra/openldap/libexec/slapd -l LOCAL0 -4 -u zimbra
-h ldap://'.
Program terminated with signal 11, Segmentation fault.
#0  0x0000002a975f21ec in syncprov_op_abandon (op=0x42002b40, rs=0x42002a50) at
syncprov.c:1026
1026                    if ( so->s_op->o_connid == op->o_connid &&
(gdb) bt
#0  0x0000002a975f21ec in syncprov_op_abandon (op=0x42002b40, rs=0x42002a50) at
syncprov.c:1026
#1  0x000000000049b8dd in overlay_op_walk (op=0x42002b40, rs=0x42002a50,
which=op_abandon, oi=0xde1e00, on=0xde1c40) at backover.c:640
#2  0x000000000049bb39 in over_op_func (op=0x42002b40, rs=0x42002a50,
which=op_abandon) at backover.c:702
#3  0x000000000049bca7 in over_op_abandon (op=0x42002b40, rs=0x42002a50) at
backover.c:760
#4  0x0000000000450729 in fe_op_abandon (op=0x42002b40, rs=0x42002a50) at
abandon.c:115
#5  0x000000000042b249 in connection_abandon (c=0x12603dd0) at connection.c:792
#6  0x000000000042b41c in connection_closing (c=0x12603dd0, why=0x4be9a0
"connection lost") at connection.c:840
#7  0x000000000042ca0f in connection_read (s=38, cri=0x42002d90) at
connection.c:1457
#8  0x000000000042c1f8 in connection_read_thread (ctx=0x42002e10, argv=0x26) at
connection.c:1254
#9  0x0000002a956c3bd7 in ldap_int_thread_pool_wrapper (xpool=0x88ce10) at
tpool.c:478
#10 0x0000003342606137 in ?? ()
#11 0x0000000000000000 in ?? ()

(gdb) frame 0
#0  0x0000002a975f21ec in syncprov_op_abandon (op=0x42002b40, rs=0x42002a50) at
syncprov.c:1026
1026                    if ( so->s_op->o_connid == op->o_connid &&
(gdb) l
1021            syncops *so, *soprev;
1022
1023            ldap_pvt_thread_mutex_lock( &si->si_ops_mutex );
1024            for ( so=si->si_ops, soprev = (syncops *)&si->si_ops; so;
1025                    soprev=so, so=so->s_next ) {
1026                    if ( so->s_op->o_connid == op->o_connid &&
1027                            so->s_op->o_msgid == op->orn_msgid ) {
1028                                    so->s_op->o_abandon = 1;
1029                                    soprev->s_next = so->s_next;
1030                                    break;
(gdb)