Memcache 1.2.5 segfaults on get

[Juergen Mathwich]

Hello

Weired problem here on a prduction system. After filling the cache with data the application tries to get an entry and the server crashes when using sendmsg - strace looks like this:

clock_gettime(CLOCK_MONOTONIC, {22182284, 807227768}) = 0
epoll_wait(3, {{EPOLLIN, {u32=5342960, u64=5342960}}}, 2050, 1000) = 1
clock_gettime(CLOCK_MONOTONIC, {22182285, 496776768}) = 0
accept(6, {sa_family=AF_INET6, sin6_port=htons(7480), inet_pton(AF_INET6, "::ffff:192.168.1.178", &sin6_addr), sin6_flowinfo=0        , sin6_scope_id=0}, [23557448941961244]) = 8
fcntl(8, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(8, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
epoll_ctl(3, EPOLL_CTL_ADD, 8, {EPOLLIN, {u32=5342992, u64=5342992}}) = 0
accept(6, 0x7fbfffdb40, [23557448941961344]) = -1 EAGAIN (Resource temporarily unavailable)
clock_gettime(CLOCK_MONOTONIC, {22182285, 497159768}) = 0
epoll_wait(3, {{EPOLLIN, {u32=5342992, u64=5342992}}}, 2050, 310) = 1
clock_gettime(CLOCK_MONOTONIC, {22182285, 497270768}) = 0
read(8, "set THISISATEST1234 0 0 1\r\n0\r\n", 4096) = 30
sendmsg(8, {msg_name(16)={sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(1)=[{"STORED\r\n", 8}], msg_co        ntrollen=0, msg_flags=0}, 0) = 8
read(8, 0x53b160, 4096)                 = -1 EAGAIN (Resource temporarily unavailable)
clock_gettime(CLOCK_MONOTONIC, {22182285, 497561768}) = 0
epoll_wait(3, {{EPOLLIN, {u32=5342992, u64=5342992}}}, 2050, 310) = 1
clock_gettime(CLOCK_MONOTONIC, {22182285, 498791768}) = 0
read(8, "delete THISISATEST1234 0\r\n", 4096) = 26
sendmsg(8, {msg_name(16)={sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(1)=[{"DELETED\r\n", 9}], msg_c        ontrollen=0, msg_flags=0}, 0) = 9
read(8, 0x53b160, 4096)                 = -1 EAGAIN (Resource temporarily unavailable)
clock_gettime(CLOCK_MONOTONIC, {22182285, 499050768}) = 0
epoll_wait(3, {{EPOLLIN, {u32=5342992, u64=5342992}}}, 2050, 309) = 1
clock_gettime(CLOCK_MONOTONIC, {22182285, 512225768}) = 0
read(8, "get SRCH_\r\n", 4096)          = 11
sendmsg(8, {msg_name(16)={sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(3)=[{"VALUE ", 6}, {"SRCH_", 5        }, {" 3 45765\r\n\37\213\10\0\0\0\0\0\0\377\315\375\351w\33"..., 1389}], msg_controllen=0, msg_flags=0}, 0) = 1400
sendmsg(8, {msg_name(16)={sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(3)=[{"\237\3708\22\247\313]\5\        36<r\264p\4\363\245\3712\326\24"..., 1400}, {"\253LC\251*[J\204\1\236.\25\333\31\212kfy\270\6|@\353\265"..., 42988}, {"END\r\n        ", 5}], msg_controllen=0, msg_flags=0}, 0) = 10136
sendmsg(8, {msg_name(16)={sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, msg_iov(2)=[{"\355|\2740\351\274\23\6*        \353|\204\237\250\363!1@\375\262"..., 34252}, {"END\r\n", 5}], msg_controllen=0, msg_flags=0}, 0) = -1 EAGAIN (Resource temporarily unavailable)
epoll_ctl(3, EPOLL_CTL_DEL, 8, {EPOLLIN, {u32=5342992, u64=5342992}}) = 0
SIGSEGV (Segmentation fault) @ 0 (0) ---

Here are some version and lib details: 
juergen at web03:~> ldd /usr/bin/memcached
        libevent-1.4.so.2 => /usr/lib/libevent-1.4.so.2 (0x0000002a9566d000)
        libc.so.6 => /lib64/tls/libc.so.6 (0x0000002a95787000)
        libnsl.so.1 => /lib64/libnsl.so.1 (0x0000002a959ae000)
        librt.so.1 => /lib64/tls/librt.so.1 (0x0000002a95ac4000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x0000002a95bcd000)
        /lib64/ld-linux-x86-64.so.2 (0x0000002a95556000)
        libpthread.so.0 => /lib64/tls/libpthread.so.0 (0x0000002a95ce1000)

memcache ist started as followed:

memcached -p 11212 -d -P /var/run/memcached/memcached-11212.pid -u memcache -m 64 -c 2048

Any ideas what's going wrong here? 

Thanks in advance,
Juergen