Bug #52613 [Opn->Asn]: crash in mysqlnd

Edit report at http://bugs.php.net/bug.php?id=52613&edit=1 ID: 52613 Updated by: felipe@php.net Reported by: manuel at mausz dot at Summary: crash in mysqlnd -Status: Open +Status: Assigned Type: Bug Package: MySQL related Operating System: Unix PHP Version: 5.3.3 -Assigned To: +Assigned To: andrey Block user comment: N Previous Comments: ------------------------------------------------------------------------ [2010-08-15 17:45:22] manuel at mausz dot at Description: ------------ mysqlnd trys to free memory which must not be valid (e.g. if memory_limit prevents that) Test script: --------------- * create a database table with a bunch of string-columns and fill in a lot of data * write a php script which fetches the content of the whole table and stores the content in an array * run the php script in a shell loop which increases the memory limit by a few kB per step. e.g: for i in $(seq 1 100); do let mem=$i*100000; echo $mem; ./sapi/cli/php -dmemory_limit=$mem crash.php; done Expected result: ---------------- no crash Actual result: -------------- (gdb) bt #0 0x0838b494 in mysqlnd_palloc_zval_ptr_dtor () #1 0x0838bbc2 in php_mysqlnd_res_free_buffered_data_pub () #2 0x0838be4a in php_mysqlnd_res_free_result_buffers_pub () #3 0x0838bf4f in mysqlnd_internal_free_result_contents () #4 0x0838bfa8 in mysqlnd_internal_free_result () #5 0x0838f984 in php_mysqlnd_res_free_result_pub () #6 0x081ef818 in _free_mysql_result () #7 0x08408ecc in list_entry_destructor () #8 0x08406e2f in zend_hash_apply_deleter () #9 0x08406f13 in zend_hash_graceful_reverse_destroy () #10 0x0840902e in zend_destroy_rsrc_list () #11 0x083fa116 in zend_deactivate () #12 0x0839adfb in php_request_shutdown () #13 0x084b6b22 in main () ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=52613&edit=1