(ITS#7965) heap corruption due to returning a reference to the local variable - openldap-bugs

14 Oct 2014


      Full_Name: Leonid Yuriev
Version: 2.4.40
OS: RHEL7
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (31.130.36.33)
#4  0x00000030e1834105 in abort () from /lib64/libc.so.6
#5  0x00000030e1876190 in malloc_printerr () from /lib64/libc.so.6
#6  0x00000000004cc593 in mdb_dn2entry (op=0x7ff36ef32380, tid=0xeb44d0, m2=0x0,
dn=0x7ff36ef323b8, e=0x7ff36ef31188, nsubs=<value optimized out>, matched=1) at
dn2entry.c:75
        mdb = 0x7ff3980da010
        rc = -30782
        rc2 = <value optimized out>
        id = 18446744073709551615
                                    0x7ff36ef30db8
        mbv = {bv_len = 0, bv_val = 0x7ff36ef30ebe ""}
        nmbv = {bv_len = 0, bv_val = 0x0}
        mc = 0x0
while the rsp is 0x7ff36ef30db8
#7  0x00000000004a6707 in mdb_modify (op=0x7ff36ef32380, rs=0x7ff36ef31450) at
modify.c:531
#8  0x0000000000487fc7 in overlay_op_walk (op=0x7ff36ef32380, rs=0x7ff36ef31450,
which=op_modify, oi=0xe0e840, on=0x0) at backover.c:671
#9  0x00000000004889b3 in over_op_func (op=0x7ff36ef32380, rs=<value optimized
out>, which=<value optimized out>) at backover.c:723
#10 0x000000000047c74inin syncrepl_del_nonpresent (op=0x7ff36ef32380,
si=0xdcc570, uuids=<value optimized out>, sc=0x7ff36ef314c0, m=89008752) at
syncrepl.c:3452
#11 0x0000000000480e92 in do_syncrep2 (op=0x7ff36ef32380, si=0xdcc570) at
syncrepl.c:1335
#12 0x00000000004843c2 in do_syncrepl (ctx=<value optimized out>, arg=0xdcc9d0)
at syncrepl.c:1539
#13 0x00007ff3987e2868 in ldap_int_thread_pool_wrapper (xpool=0xd79e80) at
tpool.c:688