infinite loop in msg_size (1.2.11)

["Mikolaj J. Habryn" <dichro-openldap-software@rcpt.to>]

  I'm having a little bit of a problem with with libldap. There's a
situation (quite rare) where a cache entry in ld->ld_cache has an
LDAPMessage with an ld_chain field pointing to itself. I instrumented
all of the places that I could find that set ld_chain to anything, and
none of them triggered, so I'm somewhat puzzled as to why it could be
happening. The data in the broken case looked a little bit dodgy  

  I'm currently just abort(3)ing out of msg_size when I detect it
doing that, but... I've just found a runaway which is actually two
chain items deep.

[root@mail06 monster]# gdb /home/monster/sendmail-9
GNU gdb 19991004
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) atta 17596
Attaching to program: /home/monster/sendmail-9, Pid 17596
Reading symbols from /lib/libdb.so.3...done.
Reading symbols from /lib/libresolv.so.2...done.
Reading symbols from /lib/libcrypt.so.1...done.
Reading symbols from /lib/libnsl.so.1...done.
Reading symbols from /lib/libdl.so.2...done.
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/ld-linux.so.2...done.
Reading symbols from /lib/libnss_files.so.2...done.
Reading symbols from /lib/libnss_dns.so.2...done.
msg_size (msg=0x40197dc8) at ../../../libraries/libldap/cache.c:606
606     ../../../libraries/libldap/cache.c: No such file or directory.
(gdb) print m
$1 = (LDAPMessage *) 0x80f4400
(gdb) print *m
$2 = {lm_msgid = 116, lm_msgtype = 113, lm_ber = 0x40197dd0, 
  lm_chain = 0x40197dd0, lm_next = 0x0, lm_time = 0}
(gdb) print *m->lm_chain
$3 = {lm_msgid = 1075412424, lm_msgtype = 135218176, lm_ber = 0x80f4400, 
  lm_chain = 0x80f4400, lm_next = 0x40197dd8, lm_time = 1075412440}
(gdb) 

  The lm_msgtype appears suspiciously large, and that's been the case
in all of the problems that I've seen so far (not all that many, to be
honest).

  Any suggestions would be deeply appreciated.

m.

PS: For additional background, this is with sendmail 8.11.0 with all
delivery data in openldap, performing a few hundred deliveries per
minute (a mix of local/non-local - the non-local don't require LDAP
lookups, the local require several).