Rsync: Segmentation fault

[Miroslaw Luc]

Rsync 2.5.5; transfer via ssh; sparc-sun-solaris2.5 (Ultra 1); gcc 2.8.1.
Every time rsync on this box causes boundary violation. I attached two
strange examples. I have a few rsync's corefiles (100MB and above) and I
can examine them. I will be grateful for any help.
-Mirek

<------------------------------------------------------------------------->
received 966761 names
done
recv_file_list done
[...]
rsync: connection unexpectedly closed (21807465 bytes read so far)
rsync error: error in rsync protocol data stream (code 12) at io.c(150)
_exit_cleanup(code=12, file=io.c, line=150): about to call exit(12)


Core was generated by `/rsync/bin/rsync --server --sender -vvvlHogDtprRS
--partial --numeric-ids . /'.
Program terminated with signal 11, Segmentation fault.
[...]
(gdb) bt
#0  0x2d898 in dopr (buffer=0xef7ffcb8 <Address 0xef7ffcb8 out of bounds>,
    maxlen=1024, format=0x3c6d8 "rsync error: %s (code %d) at %s(%d)\n",
    args=0xef800114) at lib/snprintf.c:155
Cannot access memory at address 0xef7ffad4.
(gdb) p currlen
Cannot access memory at address 0xef7ffb04.
<------------------------------------------------------------------------->


<------------------------------------------------------------------------->
io timeout after 120 seconds - exiting
rsync error: timeout in data send/receive (code 30) at io.c(85)
_exit_cleanup(code=30, file=io.c, line=85): about to call exit(30)


Core was generated by `/rsync/bin/rsync --server --sender -vvvlHogDtprRS
--timeout=120 --partial --num'.
Program terminated with signal 11, Segmentation fault.
[...]
(gdb) bt
#0  0x2d898 in dopr (buffer=0xef800118 "", maxlen=1024,
    format=0x3c6d8 "rsync error: %s (code %d) at %s(%d)\n", args=0xef800574)
    at lib/snprintf.c:155
Cannot access memory at address 0xef7fff34.
(gdb) p currlen
Cannot access memory at address 0xef7fff64.
<------------------------------------------------------------------------->