openldap client GSSAPI authentication segfaults in fbsd8stable i386

[Henrik /KaarPoSoft]

Dear All,

I have a problem: ldapsearch results in "Segmentation fault" under 
openldap-2.4.23 with cyrus-sasl-2.1.23.

A thread for similar issues was started by George Mamalakis back in 
february:
http://lists.freebsd.org/pipermail/freebsd-stable/2010-February/055017.html
but I find no solution / conclusion from this thread, hence I post here...

I have installed FreeBSD 8.0-RELEASE-p2 on i386, updated with 
freebsd-update, and ports updated with "portsnap fetch update".

Kerberos installed from packages, configured, and seems to work OK.

It seems that there are no package for openldap server with GSSAPI/SASL, 
so I have build and installed cyrus-sasl2, openldap24-server (with sasl 
configured) and openldap24-sasl-client from ports.

Those are the port versions:
# $FreeBSD: ports/security/cyrus-sasl2/Makefile,v 1.141 2009/08/02 
19:35:25 mezz Exp $
# $FreeBSD: ports/net/openldap24-server/Makefile,v 1.181 2010/07/01 
19:04:42 delphij Exp $

According to the distinfo files, those are the upstream versions:
openldap-2.4.23
cyrus-sasl-2.1.23
which, as far as I can see, are the latest stable.

Trying LDAP I get a segfault:

$ ldapsearch
SASL/GSSAPI authentication started
Segmentation fault (core dumped)

Here is the backtrace from gdb:

#0  0x283225c7 in free () from /lib/libc.so.7
#1  0x28654b42 in gss_release_buffer () from /usr/lib/libgssapi.so.10
#2  0x28654512 in gss_release_name () from /usr/lib/libgssapi.so.10
#3  0x28650e69 in gss_init_sec_context () from /usr/lib/libgssapi.so.10
#4  0x28648a0f in gssapi_client_mech_step () from 
/usr/local/lib/sasl2/libgssapiv2.so.2
#5  0x280ef4b1 in sasl_client_step () from /usr/local/lib/libsasl2.so.2
#6  0x28440200 in ?? ()
#7  0x00000000 in ?? ()
#8  0x00000000 in ?? ()
#9  0xbfbfe208 in ?? ()
#10 0xbfbfe1f4 in ?? ()
#11 0xbfbfe204 in ?? ()
#12 0x28446860 in ?? ()
#13 0x280ef3fe in sasl_client_step () from /usr/local/lib/libsasl2.so.2
#14 0xbfbfe148 in ?? ()
#15 0x280f0135 in sasl_client_start () from /usr/local/lib/libsasl2.so.2
#16 0x00000000 in ?? ()
#17 0x00000000 in ?? ()
#18 0xbfbfe208 in ?? ()
#19 0xbfbfe1f4 in ?? ()
#20 0xbfbfe204 in ?? ()
#21 0x72408f2d in ?? ()
#22 0x283b1ad8 in ?? () from /lib/libc.so.7
#23 0x00000000 in ?? ()
#24 0x283b1730 in __stderrp () from /lib/libc.so.7
#25 0xbfbfe118 in ?? ()
#26 0x28392114 in vfprintf () from /lib/libc.so.7
Previous frame inner to this frame (corrupt stack?)

I tried "valgrind ldapsearch" which produces thousands of issues, ending 
with:

==59479== Invalid free() / delete / delete[]
==59479==    at 0x59B95: free (in 
/usr/local/lib/valgrind/vgpreload_memcheck-x86-freebsd.so)
==59479==    by 0x911B41: gss_release_buffer (in /usr/lib/libgssapi.so.10)
==59479==    by 0x911511: ??? (in /usr/lib/libgssapi.so.10)
==59479==    by 0x90DE68: gss_init_sec_context (in /usr/lib/libgssapi.so.10)
==59479==    by 0x905A0E: gssapi_client_mech_step (in 
/usr/local/lib/sasl2/libgssapiv2.so.2)
==59479==    by 0xAF4B0: sasl_client_step (in /usr/local/lib/libsasl2.so.2)
==59479==    by 0xB0134: sasl_client_start (in /usr/local/lib/libsasl2.so.2)
==59479==    by 0x70C46: ldap_int_sasl_bind (in 
/usr/local/lib/libldap-2.4.so.7)
==59479==    by 0x73935: ldap_sasl_interactive_bind_s (in 
/usr/local/lib/libldap-2.4.so.7)
==59479==    by 0x80505E6: ??? (in /usr/local/bin/ldapsearch)
==59479==    by 0x804D695: ??? (in /usr/local/bin/ldapsearch)
==59479==    by 0x804A7D8: ??? (in /usr/local/bin/ldapsearch)
==59479==  Address 0x4e2c0 is not stack'd, malloc'd or (recently) free'd
==59479==
ldap_sasl_interactive_bind_s: Local error (-2)
    additional info: SASL(-1): generic failure: GSSAPI Error:  
Miscellaneous failure (see text) (unknown mech-code 2529638944 for mech 
unknown)

/var/log/messages has:
slapd[1146]: OTP unavailable because can't read/write key database 
/etc/opiekeys: Permission denied
kernel: pid 53862 (ldapsearch), uid 1001: exited on signal 11 (core dumped)

The first message is from the LDAP server. Even if it has some problem, 
it should not lead the client to segfault.

Any comments, hints or suggestions would be most appreciated!

/Henrik