Modifying particular DN with GQ crashes LDAP

[Erik Barker <openldap-software@erik.ca>]

I know we're not supposed to post GQ related inquiries to this list but
I'm not sure whether this is an LDAP or LDAP+GQ problem.

I've reproduced this on 2 separate machines running:

RedHat 7.2 (up-to-date)
openldap 2.0.23
Berkeley DB3 backend (3.2.9)
with threads

The problem I'm having is when I modify a dn with an escaped '+' located
somewhere in the dn using GQ 0.4.0, slapd crashes immediately after I
hit the 'Apply' button.

Here's a sample LDIF for what I'm working with:

dn: ou=domain, o=company
objectclass: top

dn: dc=test.com, ou=domain, o=company
objectclass: top
objectclass: testDomain
DomainName: test.com
mail: blah@hotmail.com
status: 1

dn: uid=blah\+tester, dc=test.com, ou=domain, o=company
objectclass: top
objectclass: testDomain
uid: blah+tester
DomainName: test.com
mail: blah2@hotmail.com
status: 1

The problem occurs when I try to remove the slash in the dn using GQ and
then try to update the record. I know you're not supposed to be able to
remove the slash from the dn and it should simply fail reporting an
error. Instead, it reports the error and crashes all running slapd
processes!

When I try to start slapd again, the processes start up, it seems to
respond to o=company, but ldap does NOT list any entries below that
point. I checked my DB files for corruption (simply using db_verify) and
everything *seems* to be ok. Running slapcat on the db files shows my
data still within the db files but slapd can no longer access that data
for some reason.

I've also tried modifying this entry using the command line tools as
well as an LDAP web interface (LDAPExplorer). Both methods of course
return the error but do not crash the ldap daemons. Modifying this
attribute with either TLS enabled or disabled does not appear to make a
difference in this case.

Here is a snippit of my logs:

Mar 22 12:09:00 myserver slapd[26837]: ldbm_back_modrdn: wr to children of entry DC=TEST.COM, OU=DOMAIN, O=COMPANY OK 
Mar 22 12:09:00 myserver slapd[26837]: ldbm_back_modrdn: parent dn= dc=test.com, ou=domain, o=company
Mar 22 12:09:00 myserver slapd[26837]: ldbm_back_modrdn: new ndn=UID=BLAH+TESTER,DC=TEST.COM,OU=DOMAIN,O=COMPANY
Mar 22 12:09:00 myserver slapd[26837]: => dn2id( "UID=BLAH+TESTER,DC=TEST.COM,OU=DOMAIN,O=COMPANY" ) 
Mar 22 12:09:00 myserver slapd[26837]: => ldbm_cache_open( "dn2id.dbb", 73, 600 )
Mar 22 12:09:00 myserver slapd[26837]: <= ldbm_cache_open (cache 0)  
Mar 22 12:09:00 myserver slapd[26837]: <= dn2id NOID 
Mar 22 12:09:00 myserver slapd[26837]: ldbm_back_modrdn: new ndn=UID=BLAH+TESTER,DC=TEST.COM,OU=DOMAIN,O=COMPANY does not exist
Mar 22 12:09:00 myserver slapd[26837]: ldbm_back_modrdn: can't figure out type(s)/value(s) of newrdn
Mar 22 12:09:00 myserver slapd[26837]: send_ldap_result: conn=0 op=10 p=3
Mar 22 12:09:00 myserver slapd[26837]: send_ldap_response: msgid=11 tag=109 err=1


Can anyone else reproduce this??


Thanks,


Erik