Segfault at src/lib/misc.c:1193 in 3.0.4 (3.0.11 looks very similar)

[Mike Ely]

>> Here's the backtrace:
>> #0  fr_ipaddr_cmp (a=0x20, b=0x7f3965a30510) at src/lib/misc.c:1193
>> #1  0x00007f3967740426 in check_for_realm (instance=<optimized out>, request=0x7f396f3cda40, returnrealm=0x7f3965a30580)
>>    at src/modules/rlm_realm/rlm_realm.c:276
>> #2  0x00007f396774052d in mod_preacct (instance=<optimized out>, request=0x7f396f3cda40) at src/modules/rlm_realm/rlm_realm.c:399
>> #3  0x00007f396d5f3109 in call_modsingle (request=0x7f396f3cda40, sp=0x7f396f3b3720, component=RLM_COMPONENT_PREACCT)
>>    at src/main/modcall.c:318
>
>   Hmm.. you have a fail-over pool with a mix of real home servers, and local ones (i.e. virtual servers).  This is generally not recommended, but is allowed.
>
>   I've pushed a fix.
>
>   Alan DeKok.

Unfortunately after applying the two fixes added to rlm_realm.c on 9/26 
the segfault persists. Here's the latest backtrace:

Core was generated by `/usr/sbin/radiusd -d /etc/raddb'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f48dfea1416 in check_for_realm (instance=<optimized out>, 
request=0x7f48e7870830,
     returnrealm=0x7f48dc18d580) at src/modules/rlm_realm/rlm_realm.c:276
276                             if 
(realm->acct_pool->servers[i]->ipaddr.af == AF_UNSPEC) continue;
(gdb) bt
#0  0x00007f48dfea1416 in check_for_realm (instance=<optimized out>, 
request=0x7f48e7870830,
     returnrealm=0x7f48dc18d580) at src/modules/rlm_realm/rlm_realm.c:276
#1  0x00007f48dfea153d in mod_preacct (instance=<optimized out>, 
request=0x7f48e7870830)
     at src/modules/rlm_realm/rlm_realm.c:403
#2  0x00007f48e5d54109 in call_modsingle (request=0x7f48e7870830, 
sp=0x7f48e78561b0,
     component=RLM_COMPONENT_PREACCT) at src/main/modcall.c:318
#3  modcall_recurse (request=0x7f48e7870830, 
component=RLM_COMPONENT_PREACCT, depth=1,
     entry=entry at entry=0x7f48dc18d9c8) at src/main/modcall.c:587
#4  0x00007f48e5d53a70 in modcall_child (request=<optimized out>, 
component=<optimized out>,
     depth=<optimized out>, entry=0x7f48dc18d9b0, c=<optimized out>, 
result=0x7f48dc18d824)
     at src/main/modcall.c:420
#5  0x00007f48e5d53c67 in modcall_recurse 
(request=request at entry=0x7f48e7870830,
     component=component at entry=RLM_COMPONENT_PREACCT, 
depth=depth at entry=0, entry=entry at entry=0x7f48dc18d9b0)
     at src/main/modcall.c:798
#6  0x00007f48e5d54e90 in modcall 
(component=component at entry=RLM_COMPONENT_PREACCT, c=c at entry=0x7f48e7855830,
     request=request at entry=0x7f48e7870830) at src/main/modcall.c:1138
#7  0x00007f48e5d522bf in indexed_modcall 
(comp=comp at entry=RLM_COMPONENT_PREACCT, idx=idx at entry=0,
     request=0x7f48e7870830) at src/main/modules.c:909
#8  0x00007f48e5d52e3f in module_preacct (request=<optimized out>) at 
src/main/modules.c:1867
#9  0x00007f48e5d42c65 in rad_accounting (request=0x7f48e7870830) at 
src/main/acct.c:56
#10 0x00007f48e5d62677 in request_running (request=0x7f48e7870830, 
action=<optimized out>)
     at src/main/process.c:1498
#11 0x00007f48e5d5c617 in request_handler_thread (arg=0x7f48e786f830) at 
src/main/threads.c:678
#12 0x00007f48e3f8bdc5 in start_thread (arg=0x7f48dc18e700) at 
pthread_create.c:308
#13 0x00007f48e383bced in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:113