Bug #69899 [NEW]: segfault on close() after free_result() with mysqlnd

From: phpnet at sitebytes dot nl Operating system: linux PHP version: 5.6.10 Package: MySQL related Bug Type: Bug Bug description:segfault on close() after free_result() with mysqlnd Description: ------------ When using mysqlnd, the provided test script segfaults. This does not happen using libmysqlclient. The segfault also does *not* happen (with mysqlnd) if we don't use a separate function of when we skip the free_result() call. This is tested on debian (5.6.9+dfsg-0+deb8u1) as well as on centos (5.5.26 and 5.6.10 segfault, version 5.4.42 produces a warning, and 5.3.3 (without mysqlnd) seems to be OK). gdb output (on debian) is: GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/bin/php5...Reading symbols from /usr/lib/debug/.build-id/14/e7d090b7a7289441496c5aa501c501008e4d7a.debug...done. done. (gdb) r Starting program: /usr/bin/php5 SegfaultTest.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". free result close Program received signal SIGSEGV, Segmentation fault. 0x00000000006a0f8a in _php_stream_write (stream=0x0, buf=0x7ffff7fcc438 "\005", count=9) at /tmp/buildd/php5-5.6.9+dfsg/main/streams/streams.c:1236 1236 /tmp/buildd/php5-5.6.9+dfsg/main/streams/streams.c: No such file or directory. (gdb) bt #0 0x00000000006a0f8a in _php_stream_write (stream=0x0, buf=0x7ffff7fcc438 "\005", count=9) at /tmp/buildd/php5-5.6.9+dfsg/main/streams/streams.c:1236 #1 0x00007ffff3c6c70e in php_mysqlnd_net_send_ex_pub (net=0x7ffff7fcba10, buffer=<optimized out>, count=5, conn_stats=0x114e720, error_info=0x7ffff7fca4e8) at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqlnd/mysqlnd_net.c:422 #2 0x00007ffff3c65180 in php_mysqlnd_cmd_write (_packet=0x7ffff7fcb2f8, conn=0x7ffff7fca3b0) at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqlnd/mysqlnd_wireprotocol.c:1014 #3 0x00007ffff3c5c399 in php_mysqlnd_conn_data_simple_command_send_request_pub (conn=0x7ffff7fca3b0, command=<optimized out>, arg=<optimized out>, arg_len=<optimized out>, silent=<optimized out>, ignore_upsert_status=<optimized out>) at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqlnd/mysqlnd.c:356 #4 0x00007ffff3c5a1fe in php_mysqlnd_conn_data_simple_command_pub (conn=0x7ffff7fca3b0, command=COM_STMT_CLOSE, arg=<optimized out>, arg_len=<optimized out>, ok_packet=PROT_LAST, silent=0 '\000', ignore_upsert_status=1 '\001') at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqlnd/mysqlnd.c:381 #5 0x00007ffff3c78e97 in php_mysqlnd_stmt_net_close_priv (s=0x7ffff7fc93a8, implicit=56 '8') at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqlnd/mysqlnd_ps.c:2209 #6 0x00007ffff3c78145 in php_mysqlnd_stmt_dtor_pub (s=0x7ffff7fc93a8, implicit=<optimized out>) at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqlnd/mysqlnd_ps.c:2261 #7 0x00007ffff31f8a1d in zif_mysqli_stmt_close (ht=<optimized out>, return_value=0x7ffff7fc85a0, return_value_ptr=<optimized out>, this_ptr=<optimized out>, return_value_used=<optimized out>) at /tmp/buildd/php5-5.6.9+dfsg/ext/mysqli/mysqli_api.c:2116 #8 0x00000000006dabda in dtrace_execute_internal (execute_data_ptr=<optimized out>, fci=<optimized out>, return_value_used=<optimized out>) at /tmp/buildd/php5-5.6.9+dfsg/Zend/zend_dtrace.c:97 #9 0x000000000079a370 in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7f95200) at /tmp/buildd/php5-5.6.9+dfsg/Zend/zend_vm_execute.h:560 #10 0x0000000000728da0 in execute_ex (execute_data=0x7ffff7f95200) at /tmp/buildd/php5-5.6.9+dfsg/Zend/zend_vm_execute.h:363 #11 0x00000000006daa78 in dtrace_execute_ex (execute_data=0x7ffff7f95200) at /tmp/buildd/php5-5.6.9+dfsg/Zend/zend_dtrace.c:73 #12 0x00000000006ed570 in zend_execute_scripts (type=0, type@entry=8, retval=0x7ffff7fcc438, retval@entry=0x0, file_count=9, file_count@entry=3) at /tmp/buildd/php5-5.6.9+dfsg/Zend/zend.c:1341 #13 0x00000000006892e0 in php_execute_script (primary_file=0x7fffffffcf10) at /tmp/buildd/php5-5.6.9+dfsg/main/main.c:2597 #14 0x000000000079c310 in do_cli (argc=0, argv=0x7ffff7fcc438) at /tmp/buildd/php5-5.6.9+dfsg/sapi/cli/php_cli.c:994 #15 0x000000000046286d in main (argc=0, argv=0x7ffff7fcc438) at /tmp/buildd/php5-5.6.9+dfsg/sapi/cli/php_cli.c:1378 (gdb) Just for reference, the database is not really interesting; it's freshly created with one (empty) table: mysql> show create table test; +-------+---------------------------------------------------------------------------------------------------+ | Table | Create Table | +-------+---------------------------------------------------------------------------------------------------+ | test | CREATE TABLE test ( id int(11) unsigned DEFAULT NULL ) ENGINE=InnoDB DEFAULT CHARSET=latin1 | +-------+---------------------------------------------------------------------------------------------------+ 1 row in set (0.00 sec) mysql> select * from test; Empty set (0.01 sec) mysql> Test script: --------------- <?php function create_sth(){ $dbh = new mysqli('localhost', 'testuser', 'testpass', 'testdb', 3306); $sth = $dbh->prepare('SELECT * FROM test'); if ( $dbh->errno ){ error_log(var_export($dbh->error_list, true)); } return $sth; } $sth = create_sth(); error_log("free result"); $sth->free_result(); error_log("close"); $sth->close(); error_log('Finished !'); ?> Expected result: ---------------- free result close Finished ! Actual result: -------------- debian (5.6.9) and centos (5.5.26 and 5.6.10) both produce a segfault when calling close() free result close Segmentation fault php 5.4.42 only produces a warning, but completes the script free result close PHP Warning: Error while sending STMT_CLOSE packet. PID=3182 in /home/siteadmin/SegfaultTest.php on line 14 Finished ! -- Edit bug report at https://bugs.php.net/bug.php?id=69899&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69899&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69899&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69899&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=69899&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=69899&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=69899&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=69899&r=needscript Try newer version: https://bugs.php.net/fix.php?id=69899&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=69899&r=support Expected behavior: https://bugs.php.net/fix.php?id=69899&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=69899&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=69899&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=69899&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69899&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=69899&r=dst IIS Stability: https://bugs.php.net/fix.php?id=69899&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=69899&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=69899&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=69899&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=69899&r=mysqlcfg