(ITS#5481) slapd 2.4.8+ with back-meta crashes when doing ldapsearch

[ali.pouya@free.fr]

Full_Name: Ali Pouya
Version: 2.4.8+
OS: Linux 2.6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (145.242.11.4)


Hi,
I'm trying to upgrade to back-meta 2.4.8+
I do my tests with the HEAD extracted on april 9.

When searching SOME entries slapd core dumps with the following back trace :


(gdb) bt
#0  0x00dc17a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x006d07a5 in raise () from /lib/tls/libc.so.6
#2  0x006d2209 in abort () from /lib/tls/libc.so.6
#3  0x006c9d91 in __assert_fail () from /lib/tls/libc.so.6
#4  0x080a1bad in modify_add_values (e=Variable "e" is not available.
) at mods.c:64
#5  0x080d9966 in meta_back_search (op=0x905d4f8, rs=0xa2b691c0) at
search.c:2049
#6  0x08061bbf in fe_op_search (op=0x905d4f8, rs=0xa2b691c0) at search.c:368
#7  0x08061315 in do_search (op=0x905d4f8, rs=0xa2b691c0) at search.c:217
#8  0x0805ff3a in connection_operation (ctx=0xa2b692a0, arg_v=0x905d4f8) at
connection.c:1084
#9  0x0806060e in connection_read_thread (ctx=0xa2b692a0, argv=0xb) at
connection.c:1211
#10 0x0814d149 in ldap_int_thread_pool_wrapper (xpool=0x8fb2cf0) at tpool.c:663
#11 0x00116371 in start_thread () from /lib/tls/libpthread.so.0
#12 0x00770ffe in clone () from /lib/tls/libc.so.6
(gdb)

The target server is an OpenLdap 2.3.34 managed by another team (I cannot modify
the entries).

The end of the detailed slapd log file is reproduced below. It shows that the
problem happens at the end of handling of the received data.

Some more precisions :
If I specify the attribute names (even all of them) ldapsearch is successfull !
The problem ONLY happens if I do not specify any attribute name.
ldapsearch using directly the target server (or through back-meta 2.3.7) is also
successfull.


The end of the log :

ber_dump: buf=0x905c5e0 ptr=0x905cb28 end=0x905cb66 len=62
  0000:  00 04 04 02 39 39 30 1c  04 0a 69 64 48 72 61 63   ....990...idHrac
  0010:  63 65 73 73 31 0e 04 0c  30 30 30 30 30 30 38 30   cess1...00000080
  0020:  32 34 38 38 30 18 04 08  69 64 4d 69 6e 65 66 69   24880...idMinefi
  0030:  31 0c 04 0a 31 30 30 30  32 38 33 34 39 37         1...1000283497
ber_scanf fmt ({m) ber:
ber_dump: buf=0x905c5e0 ptr=0x905cb2e end=0x905cb66 len=56
  0000:  30 1c 04 0a 69 64 48 72  61 63 63 65 73 73 31 0e   0...idHraccess1.
  0010:  04 0c 30 30 30 30 30 30  38 30 32 34 38 38 30 18   ..0000008024880.
  0020:  04 08 69 64 4d 69 6e 65  66 69 31 0c 04 0a 31 30   ..idMinefi1...10
  0030:  30 30 32 38 33 34 39 37                            00283497
ber_scanf fmt ([W]) ber:
ber_dump: buf=0x905c5e0 ptr=0x905cb3c end=0x905cb66 len=42
  0000:  00 0e 04 0c 30 30 30 30  30 30 38 30 32 34 38 38   ....000000802488
  0010:  30 18 04 08 69 64 4d 69  6e 65 66 69 31 0c 04 0a   0...idMinefi1...
  0020:  31 30 30 30 32 38 33 34  39 37                     1000283497
ber_scanf fmt ({m) ber:
ber_dump: buf=0x905c5e0 ptr=0x905cb4c end=0x905cb66 len=26
  0000:  30 18 04 08 69 64 4d 69  6e 65 66 69 31 0c 04 0a   0...idMinefi1...
  0010:  31 30 30 30 32 38 33 34  39 37                     1000283497
ber_scanf fmt ([W]) ber:
ber_dump: buf=0x905c5e0 ptr=0x905cb58 end=0x905cb66 len=14
  0000:  00 0c 04 0a 31 30 30 30  32 38 33 34 39 37         ....1000283497
ber_scanf fmt ({m) ber:
ber_dump: buf=0x905c5e0 ptr=0x905cb66 end=0x905cb66 len=0

slapd: mods.c:64: modify_add_values: Assertion `mod->sm_numvals == i' failed.
Abandon (core dumped)