Bug #72489 [NEW]: PHP Crashes When Appending Array Containing MySQLi Result Data

From: Date: Fri, 24 Jun 2016 15:49:25 +0000
Subject: Bug #72489 [NEW]: PHP Crashes When Appending Array Containing MySQLi Result Data
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-201832@lists.php.net to get a copy of this message 
From:             s7g2vp2 at yahoo dot co dot uk
Operating system: Windows Server 2012r2
PHP version:      7.0.8
Package:          MySQLi related
Bug Type:         Bug
Bug description:PHP Crashes When Appending Array Containing MySQLi Result Data

Description:
------------
We are testing our application in PHP 7 and are experiencing crashes.
This occurs when PHP is running under 64 bit Apache 2.4 using mod_php.
It also occurs when using PHP's built-in web server. 

I originally found the problem in 7.0.7 so upgraded to 7.0.8 to see if
the problem was fixed. The same code runs okay on PHP 5.4, PHP 5.5 & PHP
5.6.

The crash seems to be triggered when I append an array to a second array
(removing that line of code prevents the crash):
ie:
$resultArray[] = $itemArray;

$itemArray is an associative array that contains values fetched from a
MySQL query.

Our app runs various Update & Select queries before it reaches this
point so the crash could be the result of a problem that occurred
earlier in our code.

Test script:
---------------
Unfortunately, after several hours of trying I have been unable to
duplicate this problem outside of our application. I have provided a
backtrace.

Actual result:
--------------
DebugDiag Analysis Report 

   Dumps: 
1/1 


   Rules: 
1/1 



Analysis Summary


 Error 


Description Recommendation 

In
php__PID__14052__Date__06_24_2016__Time_03_47_12PM__902__Second_Chance_Exception_C0000005.dmp
the assembly instruction at php7ts!_emalloc+a2 in
C:\php708_debug\php7ts.dll from The PHP Group has caused an access
violation exception (0xC0000005) when trying to read from memory
location 0x00000000 on thread 0
 Please follow up with the vendor The PHP Group for
C:\php708_debug\php7ts.dll
 

Report for
php__PID__14052__Date__06_24_2016__Time_03_47_12PM__902__Second_Chance_Exception_C0000005.dmp



Type of Analysis Performed   Combined Crash/Hang Analysis 
Machine Name   xxxxx 
Operating System   Windows Server 2012 
Number Of Processors   2 
Process ID   14052 
Process Image   C:\php708_debug\php.exe 
Command Line   php -S 172.17.150.10:81 -t C:\webroot 
System Up-Time   14 day(s) 23:01:36 
Process Up-Time   00:01:48 
Processor Type   X64 
Process Bitness   64-Bit 

Top 5 Threads by CPU time


Note - Times include both user mode and kernel mode for each thread 
Thread ID: 0     Total CPU Time: 00:00:00.765     Entry Point for
Thread: php!mainCRTStartup 
Thread ID: 1     Total CPU Time: 00:00:00.000     Entry Point for
Thread: mswsock!SockAsyncThread 

CLR Information


Thread Report

Thread 0 - System ID 15772


Entry point   php!mainCRTStartup 
Create time   24/06/2016 15:45:29 
Time spent in user mode   0 Days 00:00:00.625 
Time spent in kernel mode   0 Days 00:00:00.140 

  Source

php7ts!_emalloc+a2
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_alloc.c @ 2450 +
5b]   c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_alloc.c @ 2450
+ 5b 
php7ts!_mysqlnd_pemalloc+76
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_alloc.c @
145]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_alloc.c @
145 
php7ts!php_mysqlnd_rset_field_read+978
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_wireprotocol.c
@ 1347 + e]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_wireprotocol.c
@ 1347 + e 
php7ts!php_mysqlnd_res_meta_read_metadata_pub+1b6
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result_meta.c
@ 75 + 8]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result_meta.c
@ 75 + 8 
php7ts!php_mysqlnd_res_read_result_metadata_pub+163
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result.c
@ 380 + 8]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result.c @
380 + 8 
php7ts!php_mysqlnd_stmt_prepare_pub+3d7
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_ps.c @
451 + 9]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_ps.c @ 451
+ 9 
php_mysqli!zif_mysqli_prepare+178
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqli\mysqli_api.c @
1865 + 15]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqli\mysqli_api.c @ 1865
+ 15 
php7ts!ZEND_DO_FCALL_SPEC_HANDLER+12b
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 854]
  c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 854

php7ts!execute_ex+44
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 417
+ 5]   c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h
@ 417 + 5 
php7ts!zend_execute+1f7
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 459]
  c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 459

php7ts!zend_execute_scripts+13e
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend.c @ 1428]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend.c @ 1428 
php7ts!php_execute_script+4d9
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\main\main.c @ 2494 + 1b]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\main\main.c @ 2494 + 1b 
php!php_cli_server_dispatch_script+ea
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
1941]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
1941 
php!php_cli_server_dispatch+112
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2115 + b]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2115 + b 
php!php_cli_server_recv_event_read_request+98
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2329]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2329 
php!php_cli_server_do_event_for_each_fd_callback+170
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2415]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2415 
php!php_cli_server_poller_iter_on_active+db
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
822 + f]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
822 + f 
php!php_cli_server_do_event_loop+b0
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2441 + 35]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2441 + 35 
php!do_cli_server+1f1
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2543]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @
2543 
php!main+2394
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli.c @ 1347 +
5]   c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli.c @ 1347
+ 5 
php!__scrt_common_main_seh+124
[f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 255 + 22]  
f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 255 + 22 
kernel32!BaseThreadInitThunk+d    
ntdll!RtlUserThreadStart+34    




Thread 1 - System ID 15124

Entry point   mswsock!SockAsyncThread 
Create time   24/06/2016 15:45:30 
Time spent in user mode   0 Days 00:00:00.000 
Time spent in kernel mode   0 Days 00:00:00.000 

  Source

ntdll!NtRemoveIoCompletion+a    
mswsock!SockAsyncThread+79    
kernel32!BaseThreadInitThunk+d    
ntdll!RtlUserThreadStart+34    

Exception Information


PHP7TS!_EMALLOC+A2In
php__PID__14052__Date__06_24_2016__Time_03_47_12PM__902__Second_Chance_Exception_C0000005.dmp
the assembly instruction at php7ts!_emalloc+a2 in
C:\php708_debug\php7ts.dll from The PHP Group has caused an access
violation exception (0xC0000005) when trying to read from memory
location 0x00000000 on thread 0

Module Information 

Image Name: C:\php708_debug\php7ts.dll   Symbol Type:  PDB 
Base address: 0x00000003`00905a4d   Time Stamp:  Tue Jun 21 23:57:34
2016  
Checksum: 0x00000000`00000000   Comments:   
COM DLL: False   Company Name:  The PHP Group 
ISAPIExtension: False   File Description:  PHP Script Interpreter 
ISAPIFilter: False   File Version:  7.0.8 
Managed DLL: False   Internal Name:  PHP Script Interpreter 
VB DLL: False   Legal Copyright:  Copyright © 1997-2016 The PHP Group

Loaded Image Name:  php7ts.dll   Legal Trademarks:  PHP 
Mapped Image Name:     Original filename:  php7ts.dll 
Module name:  php7ts   Private Build:   
Single Threaded:  False   Product Name:  PHP 
Module Size:  8.27 MBytes   Product Version:  7.0.8 
Symbol File Name:  c:\php708_debug\ext\php7ts.pdb   Special Build:  & 

-- 
Edit bug report at https://bugs.php.net/bug.php?id=72489&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=72489&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=72489&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=72489&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=72489&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=72489&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=72489&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=72489&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=72489&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=72489&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=72489&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=72489&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=72489&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=72489&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72489&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=72489&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=72489&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=72489&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=72489&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=72489&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=72489&r=mysqlcfg

Thread (19 messages)

« previous php.bugs (#201832) next »