Bug #72489 [Opn->Fbk]: PHP Crashes When Appending Array Containing MySQLi Result Data

From: Date: Sun, 03 Jul 2016 18:43:46 +0000
Subject: Bug #72489 [Opn->Fbk]: PHP Crashes When Appending Array Containing MySQLi Result Data
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-202028@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=72489&edit=1

 ID:                 72489
 Updated by:         ab@php.net
 Reported by:        s7g2vp2 at yahoo dot co dot uk
 Summary:            PHP Crashes When Appending Array Containing MySQLi
                     Result Data
-Status:             Open
+Status:             Feedback
 Type:               Bug
 Package:            MySQLi related
 Operating System:   Windows Server 2012r2
 PHP Version:        7.0.8
 Block user comment: N
 Private report:     N

 New Comment:

Yeah, you can't attach files on this tracker. Please share it some other way.

Thanks.


Previous Comments:
------------------------------------------------------------------------
[2016-07-01 18:24:28] s7g2vp2 at yahoo dot co dot uk

ok. I've created a full dump. It is 17MB zipped.
How do I get this to you as I cannot see any way to attach arbitrary files to the case.

------------------------------------------------------------------------
[2016-07-01 16:00:01] ab@php.net

With DebugDiag you usually also produce a crash dump. Or, you can use this technique https://msdn.microsoft.com/de-de/library/windows/desktop/bb787181(v=vs.85).aspx
. Just be sure the dump doesn't include any sensitive data.

You also could still pursue a reproduce snippet. From the backtrace you've posted, it is
something related to mysqli_prepare() usage.

Thanks.

------------------------------------------------------------------------
[2016-07-01 13:44:25] s7g2vp2 at yahoo dot co dot uk

Hi. I already included this information in my original post.

If you need me to do anything else can you provide some instructions on what I need to do.

Thanks.

------------------------------------------------------------------------
[2016-07-01 11:17:28] ab@php.net

Were it possible you to provide a crash dump?

Thanks.

------------------------------------------------------------------------
[2016-06-24 15:49:20] s7g2vp2 at yahoo dot co dot uk

Description:
------------
We are testing our application in PHP 7 and are experiencing crashes. This occurs when PHP is
running under 64 bit Apache 2.4 using mod_php. It also occurs when using PHP's built-in web
server. 

I originally found the problem in 7.0.7 so upgraded to 7.0.8 to see if the problem was fixed. The
same code runs okay on PHP 5.4, PHP 5.5 & PHP 5.6.

The crash seems to be triggered when I append an array to a second array (removing that line of code
prevents the crash):
ie:
$resultArray[] = $itemArray;

$itemArray is an associative array that contains values fetched from a MySQL query.

Our app runs various Update & Select queries before it reaches this point so the crash could be
the result of a problem that occurred earlier in our code.

Test script:
---------------
Unfortunately, after several hours of trying I have been unable to duplicate this problem outside of
our application. I have provided a backtrace.

Actual result:
--------------
DebugDiag Analysis Report 

   Dumps: 
1/1 


   Rules: 
1/1 



Analysis Summary


 Error 


Description Recommendation 

In php__PID__14052__Date__06_24_2016__Time_03_47_12PM__902__Second_Chance_Exception_C0000005.dmp the
assembly instruction at php7ts!_emalloc+a2 in C:\php708_debug\php7ts.dll from The PHP Group has
caused an access violation exception (0xC0000005) when trying to read from memory location
0x00000000 on thread 0
 Please follow up with the vendor The PHP Group for C:\php708_debug\php7ts.dll
 

Report for
php__PID__14052__Date__06_24_2016__Time_03_47_12PM__902__Second_Chance_Exception_C0000005.dmp



Type of Analysis Performed   Combined Crash/Hang Analysis 
Machine Name   xxxxx 
Operating System   Windows Server 2012 
Number Of Processors   2 
Process ID   14052 
Process Image   C:\php708_debug\php.exe 
Command Line   php -S 172.17.150.10:81 -t C:\webroot 
System Up-Time   14 day(s) 23:01:36 
Process Up-Time   00:01:48 
Processor Type   X64 
Process Bitness   64-Bit 

Top 5 Threads by CPU time


Note - Times include both user mode and kernel mode for each thread 
Thread ID: 0     Total CPU Time: 00:00:00.765     Entry Point for Thread: php!mainCRTStartup 
Thread ID: 1     Total CPU Time: 00:00:00.000     Entry Point for Thread: mswsock!SockAsyncThread 

CLR Information


Thread Report

Thread 0 - System ID 15772


Entry point   php!mainCRTStartup 
Create time   24/06/2016 15:45:29 
Time spent in user mode   0 Days 00:00:00.625 
Time spent in kernel mode   0 Days 00:00:00.140 

  Source

php7ts!_emalloc+a2 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_alloc.c @ 2450 + 5b]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_alloc.c @ 2450 + 5b 
php7ts!_mysqlnd_pemalloc+76 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_alloc.c @
145]   c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_alloc.c @ 145 
php7ts!php_mysqlnd_rset_field_read+978
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_wireprotocol.c @ 1347 + e]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_wireprotocol.c @ 1347 + e 
php7ts!php_mysqlnd_res_meta_read_metadata_pub+1b6
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result_meta.c @ 75 + 8]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result_meta.c @ 75 + 8 
php7ts!php_mysqlnd_res_read_result_metadata_pub+163
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result.c @ 380 + 8]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_result.c @ 380 + 8 
php7ts!php_mysqlnd_stmt_prepare_pub+3d7
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_ps.c @ 451 + 9]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqlnd\mysqlnd_ps.c @ 451 + 9 
php_mysqli!zif_mysqli_prepare+178 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqli\mysqli_api.c
@ 1865 + 15]   c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\ext\mysqli\mysqli_api.c @ 1865 + 15 
php7ts!ZEND_DO_FCALL_SPEC_HANDLER+12b
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 854]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 854 
php7ts!execute_ex+44 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 417 + 5]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 417 + 5 
php7ts!zend_execute+1f7 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 459]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend_vm_execute.h @ 459 
php7ts!zend_execute_scripts+13e [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend.c @ 1428]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\zend\zend.c @ 1428 
php7ts!php_execute_script+4d9 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\main\main.c @ 2494 + 1b]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\main\main.c @ 2494 + 1b 
php!php_cli_server_dispatch_script+ea
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 1941]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 1941 
php!php_cli_server_dispatch+112 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c
@ 2115 + b]   c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2115 + b 
php!php_cli_server_recv_event_read_request+98
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2329]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2329 
php!php_cli_server_do_event_for_each_fd_callback+170
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2415]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2415 
php!php_cli_server_poller_iter_on_active+db
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 822 + f]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 822 + f 
php!php_cli_server_do_event_loop+b0
[c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2441 + 35]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2441 + 35 
php!do_cli_server+1f1 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2543]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli_server.c @ 2543 
php!main+2394 [c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli.c @ 1347 + 5]  
c:\php-sdk\php70dev\vc14\x64\php-7.0.8-ts\sapi\cli\php_cli.c @ 1347 + 5 
php!__scrt_common_main_seh+124 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 255 + 22]  
f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 255 + 22 
kernel32!BaseThreadInitThunk+d    
ntdll!RtlUserThreadStart+34    




Thread 1 - System ID 15124

Entry point   mswsock!SockAsyncThread 
Create time   24/06/2016 15:45:30 
Time spent in user mode   0 Days 00:00:00.000 
Time spent in kernel mode   0 Days 00:00:00.000 

  Source

ntdll!NtRemoveIoCompletion+a    
mswsock!SockAsyncThread+79    
kernel32!BaseThreadInitThunk+d    
ntdll!RtlUserThreadStart+34    

Exception Information


PHP7TS!_EMALLOC+A2In
php__PID__14052__Date__06_24_2016__Time_03_47_12PM__902__Second_Chance_Exception_C0000005.dmp the
assembly instruction at php7ts!_emalloc+a2 in C:\php708_debug\php7ts.dll from The PHP Group has
caused an access violation exception (0xC0000005) when trying to read from memory location
0x00000000 on thread 0

Module Information 

Image Name: C:\php708_debug\php7ts.dll   Symbol Type:  PDB 
Base address: 0x00000003`00905a4d   Time Stamp:  Tue Jun 21 23:57:34 2016  
Checksum: 0x00000000`00000000   Comments:   
COM DLL: False   Company Name:  The PHP Group 
ISAPIExtension: False   File Description:  PHP Script Interpreter 
ISAPIFilter: False   File Version:  7.0.8 
Managed DLL: False   Internal Name:  PHP Script Interpreter 
VB DLL: False   Legal Copyright:  Copyright © 1997-2016 The PHP Group 
Loaded Image Name:  php7ts.dll   Legal Trademarks:  PHP 
Mapped Image Name:     Original filename:  php7ts.dll 
Module name:  php7ts   Private Build:   
Single Threaded:  False   Product Name:  PHP 
Module Size:  8.27 MBytes   Product Version:  7.0.8 
Symbol File Name:  c:\php708_debug\ext\php7ts.pdb   Special Build:  & 


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=72489&edit=1

Thread (19 messages)

« previous php.bugs (#202028) next »