Bug #70272 [NEW]: Segfault in pdo_mysql

From: laruence Operating system: PHP version: 7.0.0beta3 Package: Scripting Engine problem Bug Type: Bug Bug description:Segfault in pdo_mysql Description: ------------ A segfault can be see if the STMT object have smaller object handle than the DBH object. the reason is we destroy objects in shutdown in reverse order, so, if the STMT object have smaller handle(means is will be access later then dbh object). a segfault can be see in shutdown Test script: --------------- <?php $a = new Stdclass(); $a->a = &$a; $b = new StdClass(); $db = new PDO("mysql:host=127.0.01;dbname=test", "root"); $b = NULL; $a->c = $db; $a->b = $db->prepare("select 1"); gc_disable(); ?> Expected result: ---------------- no segfault Actual result: -------------- segfault with backtrace: Program received signal SIGSEGV, Segmentation fault. 0x0000000000737a8b in pdo_mysql_stmt_dtor (stmt=0x7ffff06761c0) at /home/huixinchen/opensource/trunk/ext/pdo_mysql/mysql_statement.c:93 93 while (mysql_more_results(S->H->server)) { (gdb) bt #0 0x0000000000737a8b in pdo_mysql_stmt_dtor (stmt=0x7ffff06761c0) at /home/huixinchen/opensource/trunk/ext/pdo_mysql/mysql_statement.c:93 #1 0x0000000000730de3 in php_pdo_free_statement (stmt=0x7ffff06761c0) at /home/huixinchen/opensource/trunk/ext/pdo/pdo_stmt.c:2320 #2 0x0000000000730fc7 in pdo_dbstmt_free_storage (std=0x7ffff0676310) at /home/huixinchen/opensource/trunk/ext/pdo/pdo_stmt.c:2356 #3 0x0000000000a45573 in zend_objects_store_free_object_storage (objects=0x13f4dd0 <executor_globals+816>) at /home/huixinchen/opensource/trunk/Zend/zend_objects_API.c:102 #4 0x00000000009e1aaa in shutdown_executor () at /home/huixinchen/opensource/trunk/Zend/zend_execute_API.c:356 #5 0x00000000009f9b14 in zend_deactivate () at /home/huixinchen/opensource/trunk/Zend/zend.c:969 #6 0x000000000096456d in php_request_shutdown (dummy=0x0) at /home/huixinchen/opensource/trunk/main/main.c:1814 #7 0x0000000000aba5f5 in do_cli (argc=2, argv=0x13f8e50) at /home/huixinchen/opensource/trunk/sapi/cli/php_cli.c:1139 #8 0x0000000000abae68 in main (argc=2, argv=0x13f8e50) at /home/huixinchen/opensource/trunk/sapi/cli/php_cli.c:1338 (gdb) -- Edit bug report at https://bugs.php.net/bug.php?id=70272&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70272&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70272&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70272&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70272&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70272&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70272&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70272&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70272&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70272&r=support Expected behavior: https://bugs.php.net/fix.php?id=70272&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70272&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70272&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70272&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70272&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70272&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70272&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70272&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70272&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70272&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70272&r=mysqlcfg