Bug #66470 [Fbk]: PHP crash (php segmentation fault)

Edit report at https://bugs.php.net/bug.php?id=66470&edit=1 ID: 66470 Updated by: pajoye@php.net Reported by: os at irj dot ru Summary: PHP crash (php segmentation fault) Status: Feedback Type: Bug Package: MySQL related Operating System: Linux Debian Sid x64 PHP Version: 5.5.8 Block user comment: N Private report: N New Comment: Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. We still need a repro script. Previous Comments: ------------------------------------------------------------------------ [2014-03-05 09:56:10] gasolwu@php.net I think i got same problem here, The backtrace stack seem like the same. #0 0x00000000005450b0 in _zend_mm_free_int () #1 0x000000000055bc85 in _zval_ptr_dtor () #2 0x00000000004fcd7e in php_mysqlnd_res_free_buffered_data_pub () #3 0x00000000004fcc9d in php_mysqlnd_res_free_result_buffers_pub () I have different version of OS and PHP as below. FreeBSD host 9.1-RELEASE-p5 FreeBSD 9.1-RELEASE-p5 #0: Sat Jul 27 01:14:23 UTC 2013 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd6 PHP 5.4.17 (cli) (built: Jul 29 2013 02:01:00) Copyright (c) 1997-2013 The PHP Group Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies ------------------------------------------------------------------------ [2014-01-13 00:26:30] johannes@php.net #1 0x00000000006acf92 in _estrndup (s=0x13c717c "Всё для кормления", length=32) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_alloc.c:2650 This should never segfault. This indicates some corruption. Can you please provide a reproducible test case or at least try to run it through valgrind? ------------------------------------------------------------------------ [2014-01-12 09:16:48] pajoye@php.net changing category looks like a mysqlnd free issue. ------------------------------------------------------------------------ [2014-01-12 09:10:25] os at irj dot ru Description: ------------ Hellow. PHP Crashed on Debian Sid x64 This error occurred on some pages You can download full core dump file: https://www.dropbox.com/s/azy1r6e725w21v0/core.php5-cgi.11199 root@home:/var/log/dumps# dpkg -l | grep php5 ii php5-cgi 5.5.8+dfsg-1 amd64 server-side, HTML-embedded scripting language (CGI binary) ii php5-cli 5.5.8+dfsg-1 amd64 command-line interpreter for the php5 scripting language ii php5-common 5.5.8+dfsg-1 amd64 Common files for packages built from the php5 source ii php5-curl 5.5.8+dfsg-1 amd64 CURL module for php5 ii php5-dbg 5.5.8+dfsg-1 amd64 Debug symbols for PHP5 ii php5-dev 5.5.8+dfsg-1 amd64 Files for PHP5 module development ii php5-gd 5.5.8+dfsg-1 amd64 GD module for php5 ii php5-json 1.3.2-2 amd64 JSON module for php5 ii php5-mcrypt 5.5.8+dfsg-1 amd64 MCrypt module for php5 ii php5-mysqlnd 5.5.8+dfsg-1 amd64 MySQL module for php5 (Native Driver) root@home:/var/log/dumps# gdb /usr/bin/php5-cgi core.php5-cgi.11199 GNU gdb (GDB) 7.6.1 (Debian 7.6.1-1) ... (gdb) bt (gdb) bt #0 _zend_mm_alloc_int (heap=0x103c300, size=33) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_alloc.c:1910 #1 0x00000000006acf92 in _estrndup (s=0x13c717c "Всё для кормления", length=32) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_alloc.c:2650 #2 0x00000000006d0b04 in _zval_copy_ctor_func (zvalue=0x143bc80) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.c:123 #3 0x00007fb347fc4902 in _zval_copy_ctor (zvalue=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:45 #4 mysqlnd_rset_zval_ptr_dtor (zv=0x1429f88, type=<optimized out>, copy_ctor_called=0x7fffb835ffaf "\001") at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:110 #5 0x00007fb347fc4c16 in php_mysqlnd_res_free_buffered_data_pub (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:200 #6 0x00007fb347fc4e05 in php_mysqlnd_res_free_result_buffers_pub (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:244 #7 0x00007fb347fc3cba in mysqlnd_internal_free_result_contents (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:274 #8 0x00007fb347fc3cea in mysqlnd_internal_free_result (result=0x139b460) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:291 #9 0x00007fb347fc3e98 in php_mysqlnd_res_free_result_pub (result=0x139b460, implicit=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqlnd/mysqlnd_result.c:1307 #10 0x00007fb342e2bce0 in mysqli_result_free_storage (object=0x14236f8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/ext/mysqli/mysqli.c:270 #11 0x00000000006f9a34 in zend_objects_store_del_ref_by_handle_ex (handle=80, handlers=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:226 #12 0x00000000006f9a53 in zend_objects_store_del_ref (zobject=0x141e7a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:178 #13 0x00000000006c1b90 in _zval_dtor (zvalue=0x141e7a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:35 #14 i_zval_ptr_dtor (zval_ptr=0x141e7a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.h:81 #15 _zval_ptr_dtor (zval_ptr=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute_API.c:426 #16 0x00000000006f3b17 in zend_object_std_dtor (object=0x141e5c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:54 #17 0x00000000006f3b49 in zend_objects_free_object_storage (object=0x141e5c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:137 #18 0x00000000006f9a34 in zend_objects_store_del_ref_by_handle_ex (handle=81, handlers=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:226 #19 0x00000000006f9a53 in zend_objects_store_del_ref (zobject=0x141ec68) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:178 #20 0x00000000006c1b90 in _zval_dtor (zvalue=0x141ec68) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:35 #21 i_zval_ptr_dtor (zval_ptr=0x141ec68) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.h:81 #22 _zval_ptr_dtor (zval_ptr=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute_API.c:426 #23 0x00000000006f3b17 in zend_object_std_dtor (object=0x141eb80) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:54 #24 0x00000000006f3b49 in zend_objects_free_object_storage (object=0x141eb80) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects.c:137 #25 0x00000000006f9a34 in zend_objects_store_del_ref_by_handle_ex (handle=82, handlers=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:226 #26 0x00000000006f9a53 in zend_objects_store_del_ref (zobject=0x141eb50) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_objects_API.c:178 #27 0x000000000077e535 in _zval_dtor (zvalue=0x141eb50) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_variables.h:35 #28 i_zval_ptr_dtor (zval_ptr=0x141eb50) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.h:81 #29 i_free_compiled_variables (execute_data=0x7fb34c0be8c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_execute.c:1510 #30 zend_leave_helper_SPEC (execute_data=0x7fb34c0be8c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:399 #31 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be8c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #32 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #33 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be7c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #34 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be7c8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #35 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #36 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be6b8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #37 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be6b8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #38 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #39 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be5a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #40 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be5a8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #41 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #42 0x0000000000780b72 in ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER (execute_data=0x7fb34c0be488) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:13370 #43 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be488) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #44 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #45 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be320) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #46 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be320) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #47 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #48 0x000000000078218c in zend_do_fcall_common_helper_SPEC (execute_data=0x7fb34c0be1c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:584 #49 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be1c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #50 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #51 0x00000000007816bf in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER (execute_data=0x7fb34c0be0c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:2748 #52 0x00000000006fb718 in execute_ex (execute_data=0x7fb34c0be0c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_vm_execute.h:363 #53 0x00000000006c1949 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend_dtrace.c:73 #54 0x00000000006d3330 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php5-EG7b3R/php5-5.5.8+dfsg/Zend/zend.c:1316 #55 0x0000000000673585 in php_execute_script (primary_file=primary_file@entry=0x7fffb83634c0) at /build/php5-EG7b3R/php5-5.5.8+dfsg/main/main.c:2506 #56 0x000000000046138a in main (argc=1, argv=0x7fffb83637f8) at /build/php5-EG7b3R/php5-5.5.8+dfsg/sapi/cgi/cgi_main.c:2454 Test script: --------------- <?php class app_catalog_categories extends app_models { ... use app_object_sql { save as SQLSave; destroy as SQLDestoy; } public function getAllCategories() { $db = new app_db; $db->query("SELECT * FROM app_catalog_category WHERE public = '1' ORDER BY position"); $objects = array(); while ($row = $db->fetch()) { $object = new app_catalog_category; $objects[] = $object->setAttributes($row); // if comment wish line script work ok! PHP don't crash. } return $objects; } ... } .. <?php trait app_object_sql { /** * Return avail attributes for object * @return array */ abstract function getSQLAttributes(); /** * Setup SQL Attributes to object * @param array $attributes */ public function setAttributes(array $attributes) { foreach ($attributes as $attribute => $value) { if (array_search($attribute, $this->getSQLAttributes()) !== false) { $this->$attribute = $value; } } return $this; } Then i rewrite two method like public function setAttributes(array $attributes) { foreach ($attributes as $attribute => $value) { if (array_search($attribute, $this->getSQLAttributes()) !== false) { $this->$attribute = $value; } } //return $this; } public function getAllCategories() { $db = new app_db; $db->query("SELECT * FROM app_catalog_category FORCE INDEX (position) WHERE public = '1' ORDER BY position"); $objects = array(); while ($row = $db->fetch()) { $object = new app_catalog_category; $object->setAttributes($row); $objects[] = $object; } return $objects; } php-cgi not crashed Expected result: ---------------- segmentation fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66470&edit=1