Bug #52546 [Csd]: pdo_dblib segmentation fault when iterating MONEY values

Edit report at http://bugs.php.net/bug.php?id=52546&edit=1 ID: 52546 Updated by: felipe@php.net Reported by: rgagnon24 at gmail dot com Summary: pdo_dblib segmentation fault when iterating MONEY values Status: Closed Type: Bug Package: PDO related Operating System: CentOS 5.5 PHP Version: 5.2.14 Assigned To: felipe Block user comment: N New Comment: Just to inform, the fix for this bug was committed just for 5.3 branch. The trunk branch has a bit different code, due some others bugs fixes trunk-only. And 5.2 branch is just accepting security bug fixes. Previous Comments: ------------------------------------------------------------------------ [2010-08-14 00:14:05] felipe@php.net This bug has been fixed in SVN. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. rgagnon24 and preben: the spprintf() function already allocates the memory, this is not the problem... The problem is that the function expect char** and I was passing char*. It must be fixed now. Thanks for the testing. ------------------------------------------------------------------------ [2010-08-14 00:12:39] felipe@php.net Automatic comment from SVN on behalf of felipe Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=302196 Log: - Fixed the fix for bug #52546 ------------------------------------------------------------------------ [2010-08-13 18:25:28] aharvey@php.net Reopening, given it's apparently still segfaulting. Felipe, can you cast an eye over the new patch, please? ------------------------------------------------------------------------ [2010-08-10 15:29:45] preben at ghost dot dk Here's a fix. Test code --------- <?php $dbh = new PDO('dblib:dbname=DB;host=HOST', 'USER', 'PASS'); $sth = $dbh->query ('create table #tmp(col money)'); $sth = $dbh->query ('insert into #tmp(col) values(123.25)'); $sth = $dbh->query ('insert into #tmp(col) values(-123.25)'); $sth = $dbh->prepare('SELECT col FROM #tmp'); $sth->execute(); $r = $sth->fetchAll(2); print_r($r); --------- Output --------- Array ( [0] => Array ( [col] => 123.2500 ) [1] => Array ( [col] => -123.2500 ) ) --------- Diff --------- --- php-5.3.3/ext/pdo_dblib/dblib_stmt.c 2010-03-08 13:39:44.000000000 +0100 +++ ../php-5.3.3/ext/pdo_dblib/dblib_stmt.c 2010-08-10 15:18:48.000000000 +0200 @@ -170,8 +170,10 @@ case SQLMONEY4: case SQLMONEYN: { DBFLT8 money_value; + val->len = (2 * dbdatlen(H->link, i + 1)) + 32; + val->data = emalloc(val->len); dbconvert(NULL, S->cols[i].coltype, dbdata(H->link, i+1), dbdatlen(H->link, i+1), SQLFLT8, (LPBYTE)&money_value, val->len); - val->len = spprintf(val->data, 0, "%.4f", money_value); + val->len = sprintf(val->data, "%.4f", money_value); } break; default: --------- ------------------------------------------------------------------------ [2010-08-06 18:18:19] rgagnon24 at gmail dot com Patch uploaded as diff of actual SVN checkout this time. Patch made from PHP_5_2 branch, but appears to be the same for PHP_5_3 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/bug.php?id=52546 -- Edit this bug report at http://bugs.php.net/bug.php?id=52546&edit=1