Problem with USRMGR.exe

[Simon Levitt]

I've been reading the messages about USRMGR.exe working correctly, and 
wondering why it doesn't here. I've been doing some digging and have 
traced the point at which our compiled version fails:

Solaris 2.6
Samba CVS'd as of about 1hr ago.

Stack trace from gdb:

#0  0xef64655c in t_splay ()
#1  0xef6463cc in t_delete ()
#2  0xef645dac in realloc ()
#3  0xa3190 in Realloc (p=0x122148, size=4178) at lib/util.c:3159
#4  0x9c2b4 in mem_realloc_data (buf=0xfb318, new_size=3154)
    at lib/membuffer.c:255
#5  0x72828 in api_rpc_command (p=0xfda48, rpc_name=0xbe338 
"api_samr_rpc", 
    api_rpc_cmds=0xe1aac, data=0xeffff380) at rpc_server/srv_util.c:674
#6  0x728ec in api_rpcTNP (p=0xfda48, rpc_name=0xbe338 "api_samr_rpc", 
    api_rpc_cmds=0xe1aac, data=0xeffff380) at rpc_server/srv_util.c:695
#7  0x6fa90 in api_samr_rpc (p=0xfda48, data=0xeffff380)
    at rpc_server/srv_samr.c:1452
#8  0x724ec in api_pipe_request (p=0xfda48, pd=0xeffff380)
    at rpc_server/srv_util.c:572
#9  0x725d8 in rpc_command (p=0xfda48, pd=0xeffff380)
    at rpc_server/srv_util.c:608
#10 0x35b00 in api_fd_reply (conn=0xeffff380, vuid=100, outbuf=0x10ff09 
"", 
    setup=0x26, data=0xfcf30 "\005", params=0x0, suwcnt=2, tdscnt=60, 
    tpscnt=0, mdrcnt=1024, mprcnt=0) at smbd/ipc.c:3236
#11 0x36274 in named_pipe (conn=0xfceb0, vuid=100, outbuf=0x10ff09 "", 
    name=0xeffff4d6 "", setup=0xff1c8, data=0xfcf30 "\005", params=0x0, 
    suwcnt=2, tdscnt=60, tpscnt=0, msrcnt=0, mdrcnt=1024, mprcnt=0)
    at smbd/ipc.c:3458
#12 0x369c8 in reply_trans (conn=0xfceb0, inbuf=0xffb01 "", 
    outbuf=0x10ff09 "", size=0, bufsize=61440) at smbd/ipc.c:3597
#13 0x53368 in switch_message (type=9, inbuf=0xffb01 "", 
outbuf=0x10ff09 "", 
    size=140, bufsize=61440) at smbd/process.c:489
#14 0x533f4 in construct_reply (inbuf=0xffb01 "", outbuf=0x10ff09 "", 
    size=140, bufsize=61440) at smbd/process.c:522
#15 0x535b4 in process_smb (inbuf=0xffb01 "", outbuf=0x10ff09 "")
    at smbd/process.c:592
#16 0x53f28 in smbd_process () at smbd/process.c:936
#17 0x25c38 in main (argc=0, argv=0xeffffc14) at smbd/server.c:713

Does this give anyone any bright ideas? The only oddity I've found is 
that buf->data and p don't match across the function call to Realloc - 
but that could be caused by the crash... (removing -O2 from the 
compilation doesn't help either).

Simon.,
-----------------------------------------------------------------------
       Simon Levitt, Consultant/Software Engineer @ WorldPay Ltd.,
       Orwell House,  Cowley Road,  Cambridge,  CB4 4WY,  ENGLAND.  
Simon.Levitt at uk.worldpay.com  Ph:+44(0)1223 715151  F:+44(0)1223 715157
----------------------- http://www.worldpay.com/ ----------------------