Bug #52613 [NEW]: crash in mysqlnd

From: Date: Sun, 15 Aug 2010 15:45:23 +0000
Subject: Bug #52613 [NEW]: crash in mysqlnd
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-153449@lists.php.net to get a copy of this message 
From:             
Operating system: Unix
PHP version:      5.3.3
Package:          MySQL related
Bug Type:         Bug
Bug description:crash in mysqlnd

Description:
------------
mysqlnd trys to free memory which must not be valid (e.g. if memory_limit
prevents that)

Test script:
---------------
* create a database table with a bunch of string-columns and fill in a lot
of data
* write a php script which fetches the content of the whole table and
stores the content in an array
* run the php script in a shell loop which increases the memory limit by a
few kB per step. e.g: for i in $(seq 1 100); do let mem=$i*100000; echo
$mem; ./sapi/cli/php -dmemory_limit=$mem crash.php; done

Expected result:
----------------
no crash

Actual result:
--------------
(gdb) bt
#0  0x0838b494 in mysqlnd_palloc_zval_ptr_dtor ()
#1  0x0838bbc2 in php_mysqlnd_res_free_buffered_data_pub ()
#2  0x0838be4a in php_mysqlnd_res_free_result_buffers_pub ()
#3  0x0838bf4f in mysqlnd_internal_free_result_contents ()
#4  0x0838bfa8 in mysqlnd_internal_free_result ()
#5  0x0838f984 in php_mysqlnd_res_free_result_pub ()
#6  0x081ef818 in _free_mysql_result ()
#7  0x08408ecc in list_entry_destructor ()
#8  0x08406e2f in zend_hash_apply_deleter ()
#9  0x08406f13 in zend_hash_graceful_reverse_destroy ()
#10 0x0840902e in zend_destroy_rsrc_list ()
#11 0x083fa116 in zend_deactivate ()
#12 0x0839adfb in php_request_shutdown ()
#13 0x084b6b22 in main ()

-- 
Edit bug report at http://bugs.php.net/bug.php?id=52613&edit=1
-- 
Try a snapshot (PHP 5.2):            http://bugs.php.net/fix.php?id=52613&r=trysnapshot52
Try a snapshot (PHP 5.3):            http://bugs.php.net/fix.php?id=52613&r=trysnapshot53
Try a snapshot (trunk):              http://bugs.php.net/fix.php?id=52613&r=trysnapshottrunk
Fixed in SVN:                        http://bugs.php.net/fix.php?id=52613&r=fixed
Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=52613&r=needdocs
Fixed in release:                    http://bugs.php.net/fix.php?id=52613&r=alreadyfixed
Need backtrace:                      http://bugs.php.net/fix.php?id=52613&r=needtrace
Need Reproduce Script:               http://bugs.php.net/fix.php?id=52613&r=needscript
Try newer version:                   http://bugs.php.net/fix.php?id=52613&r=oldversion
Not developer issue:                 http://bugs.php.net/fix.php?id=52613&r=support
Expected behavior:                   http://bugs.php.net/fix.php?id=52613&r=notwrong
Not enough info:                     http://bugs.php.net/fix.php?id=52613&r=notenoughinfo
Submitted twice:                     http://bugs.php.net/fix.php?id=52613&r=submittedtwice
register_globals:                    http://bugs.php.net/fix.php?id=52613&r=globals
PHP 4 support discontinued:          http://bugs.php.net/fix.php?id=52613&r=php4
Daylight Savings:                    http://bugs.php.net/fix.php?id=52613&r=dst
IIS Stability:                       http://bugs.php.net/fix.php?id=52613&r=isapi
Install GNU Sed:                     http://bugs.php.net/fix.php?id=52613&r=gnused
Floating point limitations:          http://bugs.php.net/fix.php?id=52613&r=float
No Zend Extensions:                  http://bugs.php.net/fix.php?id=52613&r=nozend
MySQL Configuration Error:           http://bugs.php.net/fix.php?id=52613&r=mysqlcfg

Thread (11 messages)

« previous php.bugs (#153449) next »