Full_Name: julien soula Version: 2.4.30 OS: gentoo/linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (194.254.117.85)

hello,

on a replica, when I use cookie parameter with csn value as : -c 'rid=101,csn=20120320035618.177820Z#000000#000#000000' the server crash immediately du to bad free :

#0 0x00007ffff6ac3a55 in raise () from /lib64/libc.so.6 #1 0x00007ffff6ac4d55 in abort () from /lib64/libc.so.6 #2 0x00007ffff6afe972 in ?? () from /lib64/libc.so.6 #3 0x00007ffff6b03df5 in ?? () from /lib64/libc.so.6 #4 0x00007ffff6b08d2c in free () from /lib64/libc.so.6 #5 0x00000000005b78d6 in ber_memfree_x (p=0xd45628, ctx=0x0) at memory.c:152 #6 0x00000000005b85e4 in ber_bvarray_free_x (a=0xd45660, ctx=0x0) at memory.c:731 #7 0x00000000005b8620 in ber_bvarray_free (a=0xd45660) at memory.c:741 #8 0x00000000004be085 in slap_sync_cookie_free (cookie=0x8f3140, free_cookie=1) at ldapsync.c:106 #9 0x00000000004a3ab1 in do_syncrep1 (op=0x7fffad9f8470, si=0xa0f4d0) at syncrepl.c:675 #10 0x00000000004a6e70 in do_syncrepl (ctx=0x7fffad9f8b60, arg=0xa0c4d0) at syncrepl.c:1512 #11 0x0000000000581c1f in ldap_int_thread_pool_wrapper (xpool=0x924d20) at tpool.c:688 #12 0x00007ffff7645c5c in start_thread () from /lib64/libpthread.so.0 #13 0x00007ffff6b67fcd in clone () from /lib64/libc.so.6

After some analyzes, I noticed that the allocation of this block was done with a not null memory context :

#0 ber_memalloc_x (s=41, ctx=0xd3ebd0) at memory.c:231 #1 0x00000000005b7f46 in ber_dupbv_x (dst=0x7fffad9f8350, src=0x7fffad9f8360, ctx=0xd3ebd0) at memory.c:506 #2 0x0000000000480ff9 in csnNormalize (usage=2, syntax=0x912160, mr=0x918670, val=0x7fffad9f8360, normalized=0x7fffad9f8350, ctx=0xd3ebd0) at schema_init.c:5395 #3 0x00000000004be94d in slap_parse_sync_cookie (cookie=0x8f3140, memctx=0xd3ebd0) at ldapsync.c:342 #4 0x00000000004a3a6f in do_syncrep1 (op=0x7fffad9f8470, si=0xa0f4d0) at syncrepl.c:671 #5 0x00000000004a6e70 in do_syncrepl (ctx=0x7fffad9f8b60, arg=0xa0c4d0) at syncrepl.c:1512 #6 0x0000000000581c1f in ldap_int_thread_pool_wrapper (xpool=0x924d20) at tpool.c:688 #7 0x00007ffff7645c5c in start_thread () from /lib64/libpthread.so.0 #8 0x00007ffff6b67fcd in clone () from /lib64/libc.so.6

but was freed with a null context as seen above.

If I modify the code to force a null context allocation, it works.

PS: I shortly took a look at Git code and it seems to be the same.

Best regards,