Bug 1109381

Thank you for identifying the bug, Milan.

Looking at the 389-ds-base-1.2.11 git log, once we had a NULL vs checking (Ticket #415), but it was accidentally removed by the next commit (Ticket 346).  I'm adding it back to 1.2.11 / rhel-6.6.
737169e0afd0547b6de0a61081508314d076cc6a valueset.c
commit 737169e0afd0547b6de0a61081508314d076cc6a
Author: Noriko Hosoi <nhosoi>
Date:   Thu Feb 20 14:32:41 2014 -0800
Ticket #415 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist

 slapi_valueset_find(const Slapi_Attr *a, const Slapi_ValueSet *vs, const Slapi_Value *v)
 {
        Slapi_Value *r= NULL;
-       if(!valuearray_isempty(vs->va))
+       if(vs && !valuearray_isempty(vs->va))
        {
                int i= valuearray_find(a,vs->va,v);
                if(i!=-1)
====================================================
commit 890fc22687821279f3862fc0862a4e8d93c00291
Author: Noriko Hosoi <nhosoi>
Date:   Tue Mar 4 09:35:29 2014 -0800
Ticket 346 - version 4 Slow ldapmodify operation time for large quantities of multi-valued attribute values

@@ -945,12 +710,14 @@ Slapi_Value *
 slapi_valueset_find(const Slapi_Attr *a, const Slapi_ValueSet *vs, const Slapi_Value *v)
 {
        Slapi_Value *r= NULL;
-       if(vs && !valuearray_isempty(vs->va))
-       {
-               int i= valuearray_find(a,vs->va,v);
-               if(i!=-1)
-               {
-                       r= vs->va[i];
+       if(vs->num > 0) {
+               if (vs->sorted) {
+                       r = valueset_find_sorted(a,vs,v,NULL);
+               } else {
+                       int i= valuearray_find(a,vs->va,v);
+                       if(i!=-1) {
+                               r= vs->va[i];
+                       }
                }
        }
        return r;

0) Add test entries to AD - see that it is synced over to DS
$ ldapadd -c -x -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123 -H ldap://win2k8.adrelm.com  << EOF
> dn: CN=AD_ONLY,cn=users,dc=adrelm,dc=com
> objectClass: top
> objectClass: user
> cn: AD_ONLY
> uid: AD_ONLY
> sAMAccountName: AD_ONLY
> distinguishedName: CN=AD_ONLY,cn=users,dc=adrelm,dc=com
> 
> dn: CN=AD_AND_DS,cn=users,dc=adrelm,dc=com
> objectClass: top
> objectClass: user
> cn: AD_AND_DS
> sn: AD_AND_DS
> uid: AD_AND_DS
> sAMAccountName: AD_AND_DS
> distinguishedName: CN=AD_AND_DS,cn=users,dc=adrelm,dc=com
> 
> dn: CN=grp0,cn=users,dc=adrelm,dc=com
> objectClass: top
> objectClass: Group
> cn: grp0
> distinguishedName: CN=grp0,cn=users,dc=adrelm,dc=com
> name: grp0
> sAMAccountName: grp0
> EOF
adding new entry "CN=AD_ONLY,cn=users,dc=adrelm,dc=com"

adding new entry "CN=AD_AND_DS,cn=users,dc=adrelm,dc=com"

adding new entry "CN=grp0,cn=users,dc=adrelm,dc=com"

1) Add an entry to AD with a member: DN that only exists in AD
$ ldapmodify -c -x -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com  << EOF
> dn: CN=grp0,cn=users,DC=adrelm,DC=com
> changetype: modify
> add: member
> member: CN=AD_ONLY,CN=Users,DC=adrelm,DC=com
> EOF
modifying entry "CN=grp0,cn=users,DC=adrelm,DC=com"

2) See that the ADD is synced over to DS - the DS will see that member is DN valued and try to map appropriately
$ ldapsearch -LLL -H ldap://localhost:1189 -D "cn=Directory Manager" -w Secret123 -x -b dc=passsync,dc=com "(cn=grp*)" uniquemember
dn: cn=grp0,ou=dswinsync,dc=passsync,dc=com
uniquemember: uid=AD_ONLY,ou=dswinsync,dc=passsync,dc=com

3) Change the member attribute in AD to a real user that is synced over
$ ldapmodify -c -x -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com  << EOF
> dn: CN=grp0,CN=Users,DC=adrelm,DC=com
> changetype: modify
> replace: member
> member: CN=AD_AND_DS,CN=Users,DC=adrelm,DC=com
> 
> EOF
modifying entry "CN=grp0,CN=Users,DC=adrelm,DC=com"

4) MOD is synced over to DS
$ ldapsearch -LLL -H ldap://localhost:1189 -D "cn=Directory Manager" -w Secret123 -x -b dc=passsync,dc=com "(cn=grp*)" uniquemember
dn: cn=grp0,ou=dswinsync,dc=passsync,dc=com
uniquemember: uid=AD_AND_DS,ou=dswinsync,dc=passsync,dc=com

Hence marking as VERIFIED.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1385.html