Bug #71863 [NEW]: Segfault when EXPLAIN with "Unknown column" error

From: Date: Sun, 20 Mar 2016 19:31:33 +0000
Subject: Bug #71863 [NEW]: Segfault when EXPLAIN with "Unknown column" error
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-199976@lists.php.net to get a copy of this message
From:             Azq2 at ya dot ru
Operating system: Ubuntu 14.04
PHP version:      master-Git-2016-03-20 (Git)
Package:          MySQLi related
Bug Type:         Bug
Bug description:Segfault when EXPLAIN with "Unknown column" error

Description:
------------
If execute "explain ..." query with non-existent keys - occure
segfault.

(my english very ugly, i from Ukraine)

Test script:
---------------
<?php
	$req = mysqli_connect('127.0.0.1', 'root', 'qwerty'); // <-- must
be
valid mysql server and user/password
	
	// create db and table for test
	mysqli_query($req, "CREATE DATABASE IF NOT EXISTS test42") or
die(mysqli_error($req));
	mysqli_select_db($req, 'test42') or die(mysqli_error($req));
	mysqli_query($req, "DROP TABLE IF EXISTS users") or
die(mysqli_error($req));
	mysqli_query($req, "CREATE TABLE users (id INT UNSIGNED NOT NULL
DEFAULT 0)") or die(mysqli_error($req));
	
	// segfault if EXPLAIN + "Unknown column" error
	mysqli_query($req, "EXPLAIN SELECT id FROM users WHERE
owner_id =
'2' AND object_id = '1' AND type = '0'") or
die(mysqli_error($req));


Expected result:
----------------
$ php -v
PHP 5.5.17 (cli) (built: Sep 21 2014 19:56:50) 
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies
    with Zend OPcache v7.0.4-dev, Copyright (c) 1999-2014, by Zend
Technologies

$ php 1111.php
PHP Warning:  mysqli_query(): (42S22/1054): Unknown column 'owner_id' in
'where clause' in /root/1111.php on line 11

Warning: mysqli_query(): (42S22/1054): Unknown column 'owner_id' in
'where clause' in /root/1111.php on line 11
Unknown column 'owner_id' in 'where clause'

Actual result:
--------------
(gdb) bt
#0  0x0000000000791fc4 in
mysqlnd_mysqlnd_res_store_result_fetch_data_pub (
    conn=0x7fffee66b008, result=<optimized out>, meta=<optimized out>, 
    row_buffers=0x7fffee67c008, binary_protocol=<optimized out>)
    at /home/azq2/build/php-src/ext/mysqlnd/mysqlnd_result.c:1394
#1  0x0000000000794dde in mysqlnd_mysqlnd_res_store_result_pub (
    result=0x7fffee65c8c8, conn=0x7fffee66b008, flags=<optimized out>)
    at /home/azq2/build/php-src/ext/mysqlnd/mysqlnd_result.c:1445
#2  0x0000000000782238 in mysqlnd_mysqlnd_conn_data_store_result_pub (
    conn=0x7fffee66b008, flags=<optimized out>)
    at /home/azq2/build/php-src/ext/mysqlnd/mysqlnd_connection.c:1967
#3  0x000000000066688a in zif_mysqli_query (execute_data=<optimized
out>, 
    return_value=0x7fffee614180)
    at /home/azq2/build/php-src/ext/mysqli/mysqli_nonapi.c:613
#4  0x0000000000852fcd in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER ()
    at /home/azq2/build/php-src/Zend/zend_vm_execute.h:641
#5  0x000000000083b6eb in execute_ex (ex=<optimized out>)
    at /home/azq2/build/php-src/Zend/zend_vm_execute.h:424
#6  0x0000000000891f37 in zend_execute (op_array=0x7fffee683000, 
    op_array@entry=0x7fffee684620, 
    return_value=return_value@entry=0x7fffee614030)
    at /home/azq2/build/php-src/Zend/zend_vm_execute.h:468
#7  0x00000000007fe2d4 in zend_execute_scripts (type=type@entry=8, 
    retval=0x7fffee614030, retval@entry=0x0,
file_count=file_count@entry=3)
---Type <return> to continue, or q <return> to quit---
    at /home/azq2/build/php-src/Zend/zend.c:1427
#8  0x00000000007a18c8 in php_execute_script (
    primary_file=primary_file@entry=0x7fffffffc890)
    at /home/azq2/build/php-src/main/main.c:2487
#9  0x00000000008941d8 in do_cli (argc=2, argv=0x1189950)
    at /home/azq2/build/php-src/sapi/cli/php_cli.c:974
#10 0x0000000000444e20 in main (argc=2, argv=0x1189950)
    at /home/azq2/build/php-src/sapi/cli/php_cli.c:1344


-- 
Edit bug report at https://bugs.php.net/bug.php?id=71863&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=71863&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=71863&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=71863&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=71863&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=71863&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=71863&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=71863&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=71863&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=71863&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=71863&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=71863&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=71863&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=71863&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71863&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=71863&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=71863&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=71863&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71863&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=71863&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=71863&r=mysqlcfg



Thread (15 messages)

« previous php.bugs (#199976) next »