(ITS#8087) Segmentation fault in MDB at idl.c:91 using searches - openldap-bugs

24 Mar 2015


      Full_Name: Francisco Garnelo
Version: slapd 2.4.40
OS: FreeBSD 10.1-STABLE
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (194.237.142.21)
Hi, when I try to access with a LDAP browser (Apache DS) and the browser begin
to enumerate the items in differents branches, the server crashes; this not
takes more than 30 seconds from last restart.
I experimented a similar issue with SLES 12(if not it is the same) and openldap
2.4.40 (from suse repositories) version, but in this system I could not take
evidences.
The database has more than 3GB of size and MDB is configured to support 100GB as
the maximum size.
The same databa w works fine ining BDB using an old openldap version.
#############
# Versions: #
#############
root@XXXX:/usr/local/etc/openldap # /usr/local/libexec/slapd -VVV
@(#) $OpenLDAP: slapd 2.4.40 (Mar 24 2015 17:18:46) $
        root@XXXX:/usr/rtrts/net/openldap24-server/work/openldap-2.4.40/servers/slapd
Included static overlays:
    dynlist
    seqmod
    syncprov
Included static backends:
    config
    ldif
    relay
root@xxxx:/usr/local/etc/openldap # uname -a
FreeBSD xxxx 10.1-STABLE FreeBSD 10.1-STABLE #0 r278906: Tue Feb 17 19:09:13 UTC
2015     root@releng1.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC  amd64
######################
# cn=config export:  #
######################
version: 1
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcAttributeOptions: lang-
olcAuthzPolicy: none
olcConfigDir: slapd.d
olcConfigFile: slapd.conf
olcIdleTimeout: 0
olcIndexIntLen: 8
olcIndexSubstrAnyLen: 4
olcIndexSubstrAnyStep: 2
olcIndexSubstrIfMaxLen: 4
olcIndexSubstrIfMinLen: 2
olcListenerThreads: 1
olcLocalSSF: 71
olcLogLevel: 0
olcPidFile: /var/run/openldap/slapd.pid
olcReadOnly: FALSE
olcReverseLookup: FALSE
olcSizeLimit: unlimited
olcThreads: 20
olcTLSCACertificateFile: /usr/local/etc/openldap/certs/public/ca.crt
olcTLSCertificateFile: /usr/local/etc/openldap/certs/public/server.crt
olcTLSCertificateKeyFile: /usr/local/etc/openldap/certs/private/server.key
olcTLSCRLCheck: none
olcTLSProtocolMin: 0.0
olcTLSVerifyClient: never
olcToolThreads: 2
olcWriteTimeout: 0
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModuleLoad: {0}back_mdb database  config
olcModulePath: /usr/local/libexec/openldap
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
### -- omitted content -- ###
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /r%r/local/etc/openldap/schema/rfc2307bis.schema
### -- omitted content -- ###
dn: olcDatabase={-1}frontend,cn=config
objectClass: olcFrontendConfig
objectClass: olcDatabaseConfig
olcDatabase: {-1}frontend
olcAccess: {0}to dn.base=""  by * read
olcAccess: {1}to dn.base%%2"cn=subsemema"  by * read
olcAccess: {2}to attrs=shadowLastChange  by self write  by * read
olcAccess: {3}to *  by * read
olcAddContentAcl: FALSE
olcLastMod: TRUE
olcMaxDerefDepth: 0
olcMonitoring: FALSE
olcReadOnly: FALSE
olcSchemaDN: cn=Subschema
olcSizeLimit: unlimited
olcSyncUseSubentry: FALSE
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to *  by * none
olcAddContentAcl: TRUE
olcLastMod: TRUE
olcMaxDerefDepth: 15
olcMonitoring: FALSE
olcReadOnly: FALSE
olcRootDN: cn=config
olcRootPW: XXXXX
olcSyncUseSubentry: FALSE
dn: olcDatabase={1}mdb,cn=config
objectClass: olcMdbConfig
objectClass: olcDatabaseConfig
olcDatabase: {1}mdb
olcDbDirectory:2F2Fvar/db/openldap-data.mdb
olcDbIndex: objectClass eq
olcRootDN: cn=lalala,dc=yyyyyyy,dc=com
olcRootPW: XXXXXXX
olcSuffix: dc=yyyyyyy,dc=com
########
# GDB: #
########
551194b6 => mdb_dn2id("lelreleID=6666999999@lol.com,ou=molon,dc=yyyyyyy,%3=com")
551194b6 <= mdb_entry_decode
551194b6 <= mdb_dn2id: got id=0x92b0
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 <= mdb_entry_decode
551194b6 mdb_dn2entry("lelreleID=6666999999@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b6 => mdb_entry_decode:
551194b6 => mdb_dn2id("lelreleID=6666999999@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b6 <= mdb_entry_decode
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 <= mdb_dn2id: got id=0x92b0
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 <=dbdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b6 => mdb_entry_decode:
551194b6 <= mdb_entry_decode
551194b6 <= mdb_entry_decode
551194b6 mdb_dn2entry("lelreleID=luser123@odin.lala,ou=molon,dc=yyyyyyy,dc=com")
551194b8 => mdb_dn2id("lelreleID=luser123@odin.lala,ou=molon,dc=yyyyyyy,dc=com")
551194b8 <= mdb_dn2id: got id=0x931e
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b6 => mdb_entry_decode:
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 <= mdb_entry_decode
551194b7 daemon: activity on 1 descriptor
551194b8 daemon: activity on:519194b8  11r551194b8
551194b8 daemon: read activity on 11
551194b8 mdb_dn2entry("lelreleID=6666999990@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b8 => mdb_dn2id("lelreleID=6666999990@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b7 => mdb_entry_decode:
551194b7 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 <= mdb_dn2id: got id=0x9321
551194b8 mdb_dn2entry("loloId=50,ou=fry,dc=yyyyyyy,dc=com")
551194b8 => mdb_entry_decode:
551194b8 => mdb_dn2id("loloId=50,ou=fry,dc=yyyyyyy,dc=com")
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 daemon: select: listen=6 active_threads=0 tvp=NULL
551194b8 daemon: select: listen=7 active_threads=0 tvp=NULL
551194b8 <= mdb_dn2id: got id=0xf
551194b6 <= mdb_entry_decode
551194b8 => mdb_entry_dece:3A
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 <= mdb_entry_decode
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 mdb_dn2entry("lelreleID=6666999990@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b8 => mdb_dn2id("lelreleID=6666999990@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b8 <= mdb_entry_decode
551194b8 mdb_dn2entry("lelreleID=262280000000000@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 <= mdb_dn2id: got id=0x9321
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 => mdb_dn2id("lelreleID=262280000000000@lol.com,ou=molon,dc=yyyyyyy,dc=com")
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 <= mdb_dn2id: got id=0x25
551194b8 => mdb_entry_decode:
551194b8 <= mdb_entry_decode
551194b8 => mdb_entry_decode:
551194b8 mdb_dn2entry("loloId=50,ou=fry,dc=yyyyyyy,dc=com")
551194b8 <= mdb_entry_decode
[New Thread 2103c12400 (LWP 100750/slapd)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 2103c12400 (LWP 100750/slapd)]
0x00000008024a579f in mdb_idl_search (ids=0x210a980000, id=37) at idl.c:91
91                      val = IDL_CMP( id, ids[cursor] );
Current language:  auto; currently minimal
--------------
Thanks, Francisco Garnelo