#40639 [Fbk->Opn]: DBLIB driver segfaults on repeated prepared select statements

From: Date: Mon, 26 Feb 2007 13:51:09 +0000
Subject: #40639 [Fbk->Opn]: DBLIB driver segfaults on repeated prepared select statements
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-109549@lists.php.net to get a copy of this message
 ID:               40639
 User updated by:  spheroid@php.net
 Reported By:      spheroid@php.net
-Status:           Feedback
+Status:           Open
 Bug Type:         PDO related
 Operating System: Mac OS X 10.4.8
 PHP Version:      5CVS-2007-02-26 (CVS)
 New Comment:

(gdb) p stmt
$1 = (pdo_stmt_t *) 0x172a624
(gdb) p *stmt
$2 = {
  ce = 0x24a0180, 
  properties = 0x172a6e8, 
  in_get = 0, 
  in_set = 0, 
  methods = 0x557bc0, 
  driver_data = 0x172a768, 
  executed = 1, 
  supports_placeholders = 0, 
  _reserved = 0, 
  column_count = 1, 
  columns = 0x172a95c, 
  database_object_handle = {
    value = {
      lval = 1, 
      dval = 5.5997329951816251e-307, 
      str = {
        val = 0x1 <Address 0x1 out of bounds>, 
        len = 5843616
      }, 
      ht = 0x1, 
      obj = {
        handle = 1, 
        handlers = 0x592aa0
      }
    }, 
    refcount = 2, 
    type = 5 '\005', 
    is_ref = 0 '\0'
  }, 
  dbh = 0x172a3a0, 
  bound_params = 0x172ad34, 
  bound_param_map = 0x0, 
  bound_columns = 0x0, 
  row_count = -1, 
  query_string = 0x172a740 "SELECT 'foo' WHERE '1' 
= :value", 
  query_stringlen = 31, 
  active_query_string = 0x0, 
  active_query_stringlen = 28, 
  error_code = "00000", 
  lazy_object_ref = {
    value = {
      lval = 0, 
      dval = 0, 
      str = {
        val = 0x0, 
        len = 0
      }, 
      ht = 0x0, 
      obj = {
        handle = 0, 
        handlers = 0x0
      }
    }, 
    refcount = 0, 
    type = 0 '\0', 
    is_ref = 0 '\0'
  }, 
  refcount = 1, 
  default_fetch_type = PDO_FETCH_BOTH, 
  fetch = {
    column = 0, 
    cls = {
      ce = 0x0, 
      ctor_args = 0x0, 
      retval_ptr = 0x0, 
      fci = {
        size = 0, 
        function_table = 0x0, 
        function_name = 0x0, 
        symbol_table = 0x0, 
        retval_ptr_ptr = 0x0, 
        param_count = 0, 
        params = 0x0, 
        object_pp = 0x0, 
        no_separation = 0 '\0'
      }, 
      fcc = {
        initialized = 0 '\0', 
        function_handler = 0x0, 
        calling_scope = 0x0, 
        object_pp = 0x0
      }
    }, 
    func = {
      function = 0x0, 
      fetch_args = 0x0, 
      object = 0x0, 
      fci = {
        size = 0, 
        function_table = 0x0, 
        function_name = 0x0, 
        symbol_table = 0x0, 
        retval_ptr_ptr = 0x0, 
        param_count = 0, 
        params = 0x0, 
        object_pp = 0x0, 
        no_separation = 0 '\0'
      }, 
      fcc = {
        initialized = 0 '\0', 
        function_handler = 0x0, 
        calling_scope = 0x0, 
        object_pp = 0x0
      }, 
      values = 0x0
    }, 
    into = 0x0
  }, 
  named_rewrite_template = 0x0
}
(gdb) p i
$3 = 0
(gdb) p stmt->columns[i]
$4 = {
  name = 0x0, 
  namelen = 6648949, 
  maxlen = 25, 
  param_type = 17, 
  precision = 47, 
  dbdo_data = 0x172adf4
}


Previous Comments:
------------------------------------------------------------------------

[2007-02-26 13:00:19] tony2001@php.net

Type in gdb after the segfault:
p stmt
p *stmt
p i
p stmt->columns[i]

and post the results here.

------------------------------------------------------------------------

[2007-02-26 12:52:12] spheroid@php.net

Description:
------------
The DBLIB PDO driver seems to crash when first execution of 
repeated prepared statement wont actually return any rows. If 
the first execution does return rows, it works fine.

Reproduce code:
---------------
$pdo = new PDO('dblib:host=hostname;dbname=dbname', 'user', 'pass');
$query = "SELECT 'foo' WHERE '1' = :value";
$stmt = $pdo->prepare($query);

$values = array('0', '1');

foreach ($values as $value) {
    $stmt->bindValue(':value', $value);
    $stmt->execute();    
    while ($stmt->fetch() !== false);
    $stmt->closeCursor();
}

Expected result:
----------------
Nothing.

Actual result:
--------------
(gdb) run dblib2.php 
Starting program: /usr/local/bin/php dblib2.php
Reading symbols for shared libraries .+++..+++++..++++.. done

Program received signal EXC_BAD_ACCESS, Could not access 
memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x000faf43 in do_fetch (stmt=0x172a624, do_bind=0, 
return_value=0x172a944, how=PDO_FETCH_USE_DEFAULT, 
ori=PDO_FETCH_ORI_NEXT, offset=0, return_all=0x0) at /usr/
local/src/PHP_5_2/ext/pdo/pdo_stmt.c:1026
1026                                            add_assoc_zval
(return_value, stmt->columns[i].name, val);



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=40639&edit=1


Thread (7 messages)

« previous php.bugs (#109549) next »