Bug #48240 [Asn->Csd]: DBA Segmentation fault dba_nextkey

Edit report at http://bugs.php.net/bug.php?id=48240&edit=1 ID: 48240 Updated by: felipe@php.net Reported by: VJTD3 at VJTD3 dot com Summary: DBA Segmentation fault dba_nextkey -Status: Assigned +Status: Closed Type: Bug Package: DBM/DBA related Operating System: linux redhat fedora 10 PHP Version: 5.2.9 Assigned To: felipe New Comment: The crash has been fixed, to change the behavior (when wasn't crashing) lead to BC. Previous Comments: ------------------------------------------------------------------------ [2009-05-19 05:03:00] VJTD3 at VJTD3 dot com i didn't see a reply, changed it to open in case that's needed for devs. ------------------------------------------------------------------------ [2009-05-13 07:16:08] VJTD3 at VJTD3 dot com can this be changed to return the first result if there is one and false if there are none? db_firstkey is a rewind, db_nextkey is a iterator. starting from the beginning makes sense. ------------------------------------------------------------------------ [2009-05-13 02:17:19] felipe@php.net This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. Fixed in 5.2, 5.3 and HEAD. FALSE is returned now. ------------------------------------------------------------------------ [2009-05-12 14:31:58] VJTD3 at VJTD3 dot com [New Thread 0xb7ff56c0 (LWP 10754)] Program received signal SIGSEGV, Segmentation fault. 0x080d0c66 in dba_nextkey_db4 (info=0x84d75f0, newlen=0xbfffb360) at php-5.2.9/ext/dba/dba_db4.c:222 222 if (dba->cursor->c_get(dba->cursor, &gkey, &gval, DB_NEXT) == 0) { (gdb) bt #0 0x080d0c66 in dba_nextkey_db4 (info=0x84d75f0, newlen=0xbfffb360) at php-5.2.9/ext/dba/dba_db4.c:222 #1 0x080cf3cc in zif_dba_nextkey (ht=1, return_value=0x84d6e78, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at php-5.2.9/ext/dba/dba.c:1101 #2 0x08304280 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffb548) at php-5.2.9/Zend/zend_vm_execute.h:200 #3 0x08309bba in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xbfffb548) at php-5.2.9/Zend/zend_vm_execute.h:1729 #4 0x08303dfd in execute (op_array=0x84d7538) at php-5.2.9/Zend/zend_vm_execute.h:92 #5 0x082df04e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at php-5.2.9/Zend/zend.c:1134 #6 0x0828dd81 in php_execute_script (primary_file=0xbfffd8c4) at php-5.2.9/main/main.c:2023 #7 0x0835a851 in main (argc=2, argv=0xbfffda04) at php-5.2.9/sapi/cli/php_cli.c:1133 (gdb) frame 0 #0 0x080d0c66 in dba_nextkey_db4 (info=0x84d75f0, newlen=0xbfffb360) at php-5.2.9/ext/dba/dba_db4.c:222 222 if (dba->cursor->c_get(dba->cursor, &gkey, &gval, DB_NEXT) == 0) { (gdb) frame 1 #1 0x080cf3cc in zif_dba_nextkey (ht=1, return_value=0x84d6e78, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at php-5.2.9/ext/dba/dba.c:1101 1101 nkey = info->hnd->nextkey(info, &len TSRMLS_CC); (gdb) frame 2 #2 0x08304280 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfffb548) at php-5.2.9/Zend/zend_vm_execute.h:200 200 ((zend_internal_function *) EX(function_state).f unction)->handler(opline->extended_value, EX_T(opline->result.u.var).var.ptr, EX (function_state).function->common.return_reference?&EX_T(opline->result.u.var).v ar.ptr:NULL, EX(object), return_value_used TSRMLS_CC); (gdb) frame 3 #3 0x08309bba in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xbfffb548) at php-5.2.9/Zend/zend_vm_execute.h:1729 1729 return zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS _PASSTHRU); (gdb) frame 4 #4 0x08303dfd in execute (op_array=0x84d7538) at php-5.2.9/Zend/zend_vm_execute.h:92 92 if (EX(opline)->handler(&execute_data TSRMLS_CC) > 0) { (gdb) frame 5 #5 0x082df04e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at php-5.2.9/Zend/zend.c:1134 1134 zend_execute(EG(active_op_array) TSRMLS_CC); (gdb) frame 6 #6 0x0828dd81 in php_execute_script (primary_file=0xbfffd8c4) at php-5.2.9/main/main.c:2023 2023 retval = (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, N ULL, 3, prepend_file_p, primary_file, append_file_p) == SUCCESS); (gdb) frame 7 #7 0x0835a851 in main (argc=2, argv=0xbfffda04) at php-5.2.9/sapi/cli/php_cli.c:1133 1133 php_execute_script(&file_handle TSRMLS_CC); (gdb) if you need me to go into more i can. it looks like it's just referencing a value not set till dba_firstkey is called. (does not have a previous index to find the next.) ------------------------------------------------------------------------ [2009-05-12 13:30:59] VJTD3 at VJTD3 dot com <?php $dba = dba_open('database', 'c', 'db4'); dba_insert('php', 'crashed', $dba); $key = dba_nextkey($dba); echo $key.':'.dba_fetch($key, $dba)."\n"; ?> that alone will seg fault. it's happens on any database driver when dba_nextkey is used before dba_firstkey. that snippet will create a fresh database and crash to test easier. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/bug.php?id=48240 -- Edit this bug report at http://bugs.php.net/bug.php?id=48240&edit=1