slapd crash when using SQL backend

I've not narrowed down the minimum scenario that causes it. But the bug is quite obvious from reading the code. There's a free() that should definitely not be called as it is made on an address that is not the result of an allocation.

Please find diff attached (it may not be *the* best/correct solution as I've not deeply analysed why the code was written that way but it seems to fix it for me).

hardy is also affected.

Below is valgrind and gdb information.

The crash occurs when a client connects and does a search. I suppose just setting up openldap with a SQL backend would be enough.

Valgrind:

==>backsql_search(): base="*****************", filter="(objectClass=*)", scope=2, deref=0, attrsonly=0, attributes to load: all
==>backsql_get_db_conn()
==>backsql_open_db_handle()
do_bind: v3 anonymous bind
<==backsql_open_db_handle()
<==backsql_get_db_conn()
==>backsql_dn2id("****MASKED****") matched expected
==>backsql_id2entry()
==32193==
==32193== Thread 4:
==32193== Invalid free() / delete / delete[]
==32193== at 0x4824B4A: free (vg_replace_malloc.c:323)
==32193== by 0x489AE28: ber_memfree_x (memory.c:152)
==32193== by 0x6058F: ch_free (ch_malloc.c:139)
==32193== by 0x53F86BF: backsql_id2entry (entry-id.c:945)
==32193== by 0x53ED183: backsql_init_search (search.c:315)
==32193== by 0x53F1B04: backsql_search (search.c:2034)
==32193== by 0x3F8C8: fe_op_search (search.c:366)
==32193== by 0x3F21B: do_search (search.c:217)
==32193== by 0x3B8F9: connection_operation (connection.c:1084)
==32193== by 0x3BE54: connection_read_thread (connection.c:1211)
==32193== by 0x485219A: ldap_int_thread_pool_wrapper (tpool.c:663)
==32193== by 0x49E750E: start_thread (in /lib/tls/i686/cmov/libpthread-2.8.90.so)
==32193== Address 0x4e31c24 is 444 bytes inside a block of size 40,004 alloc'd
==32193== at 0x4823DE2: calloc (vg_replace_malloc.c:397)
==32193== by 0x489B034: ber_memcalloc_x (memory.c:277)
==32193== by 0x6039A: ch_calloc (ch_malloc.c:104)
==32193== by 0x4A15E: entry_prealloc (entry.c:548)
==32193== by 0x4A22D: entry_alloc (entry.c:575)
==32193== by 0x53EBCDD: read_baseObject (config.c:677)
==32193== by 0x53EAC96: backsql_db_config (config.c:448)
==32193== by 0x2F1BB: read_config_file (config.c:786)
==32193== by 0x23A21: read_config (bconfig.c:3463)
==32193== by 0x18DF7: main (main.c:754)

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb6dddb90 (LWP 426)]
0xb7ee0430 in __kernel_vsyscall ()
(gdb) bt full
#0 0xb7ee0430 in __kernel_vsyscall ()
No symbol table info available.
#1 0xb79f38a0 in raise () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2 0xb79f5268 in abort () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#3 0xb7a3116d in ?? () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#4 0xb7a37454 in ?? () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#5 0xb7a394b6 in free () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#6 0xb7e54e29 in ber_memfree_x (p=0xb830b13c, ctx=0x0) at /home/stephane/install/DEB/openldap-2.4.11/libraries/liblber/memory.c:152
        __PRETTY_FUNCTION__ = "ber_memfree_x"
#7 0xb7f43590 in ch_free (ptr=0xb830b13c) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/ch_malloc.c:139
        ctx = (void *) 0x0
#8 0xb76ef6c0 in backsql_id2entry (bsi=0xb6ddbdb8, eid=0xb6ddbdcc) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/back-sql/entry-id.c:945
        e = (Entry *) 0xb830b13c
        op = (Operation *) 0xb836ac40
        bi = (backsql_info *) 0xb82f5358
        i = 1203274741
        rc = -1209131020
        __PRETTY_FUNCTION__ = "backsql_id2entry"
#9 0xb76e4184 in backsql_init_search (bsi=0xb6ddbdb8, nbase=0xb836ac5c, scope=2, stoptime=1240841287, filter=0xb68dc12c, dbh=0xb8385b90, op=0xb836ac40, rs=0xb6ddd12c, attrs=0x0, flags=11)
    at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/back-sql/search.c:315
        matched = 1
        getentry = 1
        gotit = 1
        bi = (backsql_info *) 0xb82f5358
        rc = 0
        __PRETTY_FUNCTION__ = "backsql_init_search"
#10 0xb76e8b05 in backsql_search (op=0xb836ac40, rs=0xb6ddd12c) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/back-sql/search.c:2034
        bi = (backsql_info *) 0xb82f5358
        dbh = (SQLHDBC) 0xb8385b90
        sres = 0
        user_entry = {e_id = 0, e_name = {bv_len = 0, bv_val = 0x0}, e_nname = {bv_len = 0, bv_val = 0x0}, e_attrs = 0x0, e_ocflags = 0, e_bv = {bv_len = 0, bv_val = 0x0}, e_private = 0x0}
        base_entry = {e_id = 0, e_name = {bv_len = 17, bv_val = 0xb8359908 "****MASKED****"}, e_nname = {bv_len = 17, bv_val = 0xb8359340 "****MASKED****"}, e_attrs = 0xb83169cc,
  e_ocflags = 0, e_bv = {bv_len = 0, bv_val = 0x0}, e_private = 0x0}
        manageDSAit = 0
        stoptime = 1240841287
        bsi = {bsi_op = 0xb836ac40, bsi_rs = 0xb6ddd12c, bsi_flags = 1, bsi_base_ndn = 0xb836ac5c, bsi_use_subtree_shortcut = 0, bsi_base_id = {eid_id = 0, eid_keyval = 0, eid_oc_id = 0,
    eid_oc = 0x0, eid_dn = {bv_len = 17, bv_val = 0xb68dc16c "****MASKED****"}, eid_ndn = {bv_len = 17, bv_val = 0xb68dc154 "****MASKED****"}, eid_next = 0x0}, bsi_scope = 2,
  bsi_filter = 0xb68dc12c, bsi_stoptime = 1240841287, bsi_id_list = 0x0, bsi_id_listtail = 0xb6ddbdfc, bsi_c_eid = 0x0, bsi_n_candidates = 0, bsi_status = 0, bsi_oc = 0x0, bsi_sel = {
    bb_val = {bv_len = 0, bv_val = 0x0}, bb_len = 0}, bsi_from = {bb_val = {bv_len = 0, bv_val = 0x0}, bb_len = 0}, bsi_join_where = {bb_val = {bv_len = 0, bv_val = 0x0}, bb_len = 0},
  bsi_flt_where = {bb_val = {bv_len = 0, bv_val = 0x0}, bb_len = 0}, bsi_filter_oc = 0x0, bsi_dbh = 0xb8385b90, bsi_attrs = 0x0, bsi_e = 0xb6ddbeb8}
        eid = (backsql_entryID *) 0x0
        nbase = {bv_len = 0, bv_val = 0x0}
        lastid = 0
#11 0xb7f228c9 in fe_op_search (op=0xb836ac40, rs=0xb6ddd12c) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/search.c:366
        bd = (BackendDB *) 0xb8036a20
#12 0xb7f2221c in do_search (op=0xb836ac40, rs=0xb6ddd12c) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/search.c:217
        base = {bv_len = 17, bv_val = 0xb836d14f "****MASKED****"}
        siz = 0
        off = 0
        i = 0
#13 0xb7f1e8fa in connection_operation (ctx=0xb6ddd21c, arg_v=0xb836ac40) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/connection.c:1084
        rc = 80
---Type <return> to continue, or q <return> to quit---
        op = (Operation *) 0xb836ac40
        rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = 0, sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_sasl = {r_sasldata = 0x0},
    sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}, sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}}, sr_flags = 0}
        tag = 99
        opidx = SLAP_OP_SEARCH
        conn = (Connection *) 0xb767f0e8
        memctx = (void *) 0xb836d120
        memctx_null = (void *) 0x0
        memsiz = 1048576
        __PRETTY_FUNCTION__ = "connection_operation"
#14 0xb7f1ee55 in connection_read_thread (ctx=0xb6ddd21c, argv=0xc) at /home/stephane/install/DEB/openldap-2.4.11/servers/slapd/connection.c:1211
        rc = 0
        cri = {op = 0xb836ac40, func = 0, arg = 0x0, ctx = 0xb6ddd21c, nullop = 0}
        s = 12
#15 0xb7e6919b in ldap_int_thread_pool_wrapper (xpool=0xb82e28c8) at /home/stephane/install/DEB/openldap-2.4.11/libraries/libldap_r/tpool.c:663
        pool = (struct ldap_int_thread_pool_s *) 0xb82e28c8
        task = (ldap_int_thread_task_t *) 0xb83200d0
        work_list = (ldap_int_tpool_plist_t *) 0xb82e2948
        ctx = {ltu_id = 3067992976, ltu_key = {{ltk_key = 0xb7f1e444, ltk_data = 0xb836d030, ltk_free = 0xb7f1e217 <conn_counter_destroy>}, {ltk_key = 0xb7f8b659, ltk_data = 0xb836d120,
      ltk_free = 0xb7f8b480 <slap_sl_mem_destroy>}, {ltk_key = 0xb7f38ea7, ltk_data = 0x0, ltk_free = 0xb7f38e04 <slap_op_q_destroy>}, {ltk_key = 0xb770b410, ltk_data = 0xb8385b90,
      ltk_free = 0xb76f4b23 <backsql_db_conn_keyfree>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 28 times>}}
        kctx = (ldap_int_thread_userctx_t *) 0x0
        i = 32
        keyslot = 734
        hash = 5416670
        __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper"
#16 0xb7cf950f in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#17 0xb7aa9a0e in clone () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.

ProblemType: Bug
Architecture: i386
DistroRelease: Ubuntu 8.10
NonfreeKernelModules: nvidia
Package: slapd 2.4.11-0ubuntu6
ProcEnviron:
 SHELL=/bin/zsh
 PATH=/home/username/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/var/lib/gems/1.8/bin:/var/lib/gems/1.9.0/bin
 LANG=en_GB.UTF-8
SourcePackage: openldap
Uname: Linux 2.6.27-14-generic i686