Bug #67130 [NEW]: nextRowset causes memory corruption
From: kaido at tradenet dot ee
Operating system: linux
PHP version: master-Git-2014-04-24 (Git)
Package: PDO DBlib
Bug Type: Bug
Bug description:nextRowset causes memory corruption
Description:
------------
php:
PHP 5.4.29-dev (cli) (built: Apr 24 2014 16:49:28) (DEBUG)
configured with:
./configure --enable-debug --with-mssql --with-pdo-dblib
--enable-mbstring
calling PDOStatement::nextRowset() corrupts memory.
Test script:
---------------
replace server/database names and login credentials.
freetds.conf has 'tds version = 8.0' as only item in 'global' section.
<?php
$dsn = "dblib:host=xxxxx.xxxx.xxx;dbname=xxx";
$pdo = new PDO($dsn, 'user', 'password');
$stmt = $pdo->query('select 1');
$stmt->fetch();
$stmt->nextRowset();
?>
Actual result:
--------------
[Thu Apr 24 23:19:09 2014] Script: '/webroot/k2/ekl/b1.php'
---------------------------------------
/root/php/php-src/ext/pdo/pdo_stmt.c(2074) : Block 0x03058a48 status:
Beginning: Freed (magic=0x00000000, expected=0x99954317)
Start: Overflown (magic=0x00000000 instead of 0x541E9F24)
At least 4 bytes overflown
End: Overflown (magic=0x00000000 instead of 0x546AF508)
At least 4 bytes overflown
---------------------------------------
Warning: PDOStatement::nextRowset(): SQLSTATE[HY000]: General error:
PDO_DBLIB: dbresults() returned FAIL in /webroot/k2/ekl/b1.php on line
10
[Thu Apr 24 23:19:09 2014] Script: '/webroot/k2/ekl/b1.php'
/root/php/php-src/ext/pdo_dblib/pdo_dblib.c(113) : Freeing
0x7F109142F9C0 (8 bytes), script=/webroot/k2/ekl/b1.php
[Thu Apr 24 23:19:09 2014] Script: '/webroot/k2/ekl/b1.php'
/root/php/php-src/ext/pdo_dblib/pdo_dblib.c(118) : Freeing
0x7F1091431490 (73 bytes), script=/webroot/k2/ekl/b1.php
=== Total 2 memory leaks detected ===
--
Edit bug report at https://bugs.php.net/bug.php?id=67130&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=67130&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=67130&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=67130&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=67130&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=67130&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=67130&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=67130&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=67130&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=67130&r=support
Expected behavior: https://bugs.php.net/fix.php?id=67130&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=67130&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=67130&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=67130&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=67130&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=67130&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=67130&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=67130&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=67130&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=67130&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=67130&r=mysqlcfg
Thread (9 messages)
- kaido at tradenet dot ee