#49937 [NEW]: Race condition in PDOStatement

From: Date: Tue, 20 Oct 2009 22:43:54 +0000
Subject: #49937 [NEW]: Race condition in PDOStatement
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-143742@lists.php.net to get a copy of this message 
From:             basantk@php.net
Operating system: Linux
PHP version:      5.2.11
PHP Bug Type:     PDO related
Bug description:  Race condition in PDOStatement

Description:
------------
There is a race condition in pdo's stmt PDOStatement class.
This class is dynamically created and it adds a member named queryString
(inside pdo_stmt_init).
zend_declare_property_null allocates property using malloc.

Later pdo_dbstmt_ce is copied to other hashes in pdo_dbstmt_new.
zend_hash_copy increments refcount of pdo_dbstmt_ce->queryString property.
In
multithreaded php refcount increment was not atomic. It was causing
refcount
to become 0 and hence efree was trying to delete something which was
allocated
from malloc.



There is a php benchmark kit named olio and can be downloaded from :
https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_SMI-Site/en_US/-/USD/ViewProductDetail-Start?ProductRef=Olio-PHP-1.0-A-G-F@CDS-CDS_SMI

The bug is easily reproducible with olio php benchmark inside Sun Web
Server.


Expected result:
----------------
Correct functionality

Actual result:
--------------
Stack trace :
--------------
Program terminated with signal 11, Segmentation fault.
#0  0x00002ba1630451e0 in _zend_mm_free_int ()
  from /home/sun/webserver7/bin/libphp5.so
#1  0x00002ba163084aa0 in zend_std_write_property ()
  from /home/sun/webserver7/bin/libphp5.so
#2  0x00002ba162ebfc4a in pdo_stmt_construct ()
  from /home/sun/webserver7/bin/libphp5.so
#3  0x00002ba162ec0073 in zim_PDO_query ()
  from /home/sun/webserver7/bin/libphp5.so
#4  0x00002ba1630999f9 in zend_do_fcall_common_helper_SPEC ()
  from /home/sun/webserver7/bin/libphp5.so
#5  0x00002ba16308705f in execute () from
/home/sun/webserver7/bin/libphp5.so
#6  0x00002ba1630993d8 in zend_do_fcall_common_helper_SPEC ()
  from /home/sun/webserver7/bin/libphp5.so
#7  0x00002ba16308705f in execute () from
/home/sun/webserver7/bin/libphp5.so
#8  0x00002ba1630630fa in zend_execute_scripts ()
  from /home/sun/webserver7/bin/libphp5.so
#9  0x00002ba1630188bb in php_execute_script ()
  from /home/sun/webserver7/bin/libphp5.so
#10 0x00002ba1630ee465 in php5_execute ()



-- 
Edit bug report at http://bugs.php.net/?id=49937&edit=1
-- 
Try a snapshot (PHP 5.2):            http://bugs.php.net/fix.php?id=49937&r=trysnapshot52
Try a snapshot (PHP 5.3):            http://bugs.php.net/fix.php?id=49937&r=trysnapshot53
Try a snapshot (PHP 6.0):            http://bugs.php.net/fix.php?id=49937&r=trysnapshot60
Fixed in SVN:                        http://bugs.php.net/fix.php?id=49937&r=fixed
Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=49937&r=needdocs
Fixed in release:                    http://bugs.php.net/fix.php?id=49937&r=alreadyfixed
Need backtrace:                      http://bugs.php.net/fix.php?id=49937&r=needtrace
Need Reproduce Script:               http://bugs.php.net/fix.php?id=49937&r=needscript
Try newer version:                   http://bugs.php.net/fix.php?id=49937&r=oldversion
Not developer issue:                 http://bugs.php.net/fix.php?id=49937&r=support
Expected behavior:                   http://bugs.php.net/fix.php?id=49937&r=notwrong
Not enough info:                     http://bugs.php.net/fix.php?id=49937&r=notenoughinfo
Submitted twice:                     http://bugs.php.net/fix.php?id=49937&r=submittedtwice
register_globals:                    http://bugs.php.net/fix.php?id=49937&r=globals
PHP 4 support discontinued:          http://bugs.php.net/fix.php?id=49937&r=php4
Daylight Savings:                    http://bugs.php.net/fix.php?id=49937&r=dst
IIS Stability:                       http://bugs.php.net/fix.php?id=49937&r=isapi
Install GNU Sed:                     http://bugs.php.net/fix.php?id=49937&r=gnused
Floating point limitations:          http://bugs.php.net/fix.php?id=49937&r=float
No Zend Extensions:                  http://bugs.php.net/fix.php?id=49937&r=nozend
MySQL Configuration Error:           http://bugs.php.net/fix.php?id=49937&r=mysqlcfg

Thread (22 messages)

« previous php.bugs (#143742) next »