+++ This bug was initially created as a clone of Bug #796509 +++

Description of problem:

Creating a netgroup with a leading + causes ns-slapd to segfault in the compat plugin.

I opened this against slapi-nis because using ipa-compat-manage disable makes this operation work. Re-enabling the plugin after adding the entry causes 389-ds to not start.

The backtrace seems to be in 389-ds itself.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f623b7fe700 (LWP 27025)]
__strlen_sse2 () at ../sysdeps/x86_64/strlen.S:32
32              movdqu  (%rdi), %xmm1
(gdb) where
#0  __strlen_sse2 () at ../sysdeps/x86_64/strlen.S:32
#1  0x0000003931cb4caa in slapi_value_set_string_passin (value=0x7f623b7f7450, 
    strVal=0x0) at ldap/servers/slapd/value.c:381
#2  0x0000003931cb657c in valueset_add_string (vs=0x7f623c0e0268, s=0x0, 
    t=<optimized out>, csn=<optimized out>)
    at ldap/servers/slapd/valueset.c:1028
#3  0x0000003931c54d27 in slapi_entry_add_string (e=<optimized out>, 
    type=<optimized out>, value=0x0) at ldap/servers/slapd/entry.c:2650
#4  0x00007f62583392b7 in backend_set_operational_attributes (
    e=0x7f623c0e03e0, state=0x13baa30, timestamp=1329967375, n_subordinates=0)
    at back-sch.c:275
#5  0x00007f625833a83c in backend_set_entry (pb=0x1c1cd40, e=0x7f623c0df730, 
    data=0x19becc0) at back-sch.c:336
#6  0x00007f625833da1a in backend_shr_add_entry_cb (
    group=0x1537ae0 "cn=compat,dc=greyoak,dc=com", set=0x1535e00 "cn=ng", 
    secure=<optimized out>, backend_data=0x19becc0, cbdata_ptr=0x7f623b7f7770)
    at back-shr.c:1545
#7  0x00007f62583482a8 in map_data_foreach_map (state=<optimized out>, 
    domain_name=0x0, fn=0x7f625833d9d0 <backend_shr_add_entry_cb>, 
    cbdata=0x7f623b7f7770) at map.c:347
#8  0x00007f625833ded7 in backend_shr_add_cb (pb=0x1c1cd40) at back-shr.c:1611
#9  backend_shr_add_cb (pb=0x1c1cd40) at back-shr.c:1551
#10 0x0000003931c8a359 in plugin_call_func (list=0x13bc790, operation=560, 
    pb=0x1c1cd40, call_one=0) at ldap/servers/slapd/plugin.c:1450
#11 0x0000003931c8a554 in plugin_call_list (pb=0x1c1cd40, operation=560, 
    list=<optimized out>) at ldap/servers/slapd/plugin.c:1412
#12 plugin_call_plugins (pb=0x1c1cd40, whichfunction=560)
    at ldap/servers/slapd/plugin.c:395
#13 0x00007f6259fecb45 in ldbm_back_add (pb=0x1c1cd40)
    at ldap/servers/slapd/back-ldbm/ldbm_add.c:918
#14 0x0000003931c3f3b7 in op_shared_add (pb=0x1c1cd40)
    at ldap/servers/slapd/add.c:680
#15 0x0000003931c404c8 in do_add (pb=0x1c1cd40) at ldap/servers/slapd/add.c:258
#16 0x0000000000417098 in connection_dispatch_operation (pb=<optimized out>, 
    op=0x1c1ca30, conn=0x7f6250afc560) at ldap/servers/slapd/connection.c:576
#17 connection_threadmain () at ldap/servers/slapd/connection.c:2336
#18 0x0000003866e28553 in _pt_root (arg=0x148d4a0)
    at ../../../mozilla/nsprpub/pr/src/pthreads/ptthread.c:187
#19 0x0000003863e07b41 in start_thread (arg=0x7f623b7fe700)
    at pthread_create.c:305
#20 0x00000038636df49d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
(gdb) up
#1  0x0000003931cb4caa in slapi_value_set_string_passin (value=0x7f623b7f7450, 
    strVal=0x0) at ldap/servers/slapd/value.c:381
381             value->bv.bv_len = strlen(strVal);
(gdb) print strVal
$1 = 0x0

Version-Release number of selected component (if applicable):

389-ds-base-1.2.10.1-1.fc15.x86_64
slapi-nis-0.36-1.fc15.x86_64

Steps to Reproduce:
1. yum install freeipa-server
2. ipa-server-install
3. kinit admin
4. ipa netgroup-add --desc=bad +bad

--- Additional comment from nalin on 2012-02-23 14:10:32 EST ---

At line back-sch.c:275 we're trying setting the 'entryDN' to the entry's DN, which should already have been set in the calling function, so there's an error case here that the plugin's not handling right.

--- Additional comment from nalin on 2012-02-23 20:01:38 EST ---

The plugin is failing to correctly escape values used in constructing the RDN, and that's letting it create entries with malformed DNs attached to them that sometimes get retrieved as NULL.

I'm targeting 0.38 for the fix -- if you can test with a version dated after 2012-02-24-01:00:00Z, they should handle such cases (not just entries with names containing "+", but other important characters such as "=", ":", and the like) correctly.

--- Additional comment from nalin on 2012-03-06 12:31:22 EST ---

Have you had a chance to test yet?  If it passes muster, I can tag a release and start the ball rolling on updates.

--- Additional comment from rcritten on 2012-03-06 14:11:42 EST ---

Confirmed, no more core dump.