Bug #72788 [NEW]: Invalid memory access when using persistent PDO connection

From: keyur Operating system: Linux PHP version: 7.0.9 Package: PDO Core Bug Type: Bug Bug description:Invalid memory access when using persistent PDO connection Description: ------------ Run the following script with Valgrind enabled and you'll see invalid memory accesses like so. These sometimes cause seg faults. ==18213== Invalid read of size 4 ==18213== at 0x628322: pdo_mysql_stmt_dtor (mysql_statement.c:91) ==18213== by 0x624749: php_pdo_free_statement (pdo_stmt.c:2323) ==18213== by 0x83AFB0: zend_objects_store_del (zend_objects_API.c:178) ==18213== by 0x61C27F: pdo_dbh_attribute_set (pdo_dbh.c:805) ==18213== by 0x61C932: zim_PDO_dbh_constructor (pdo_dbh.c:385) ==18213== by 0x87D39A: ZEND_DO_FCALL_SPEC_HANDLER (zend_vm_execute.h:842) ==18213== by 0x83EDDA: execute_ex (zend_vm_execute.h:414) ==18213== by 0x888EB6: zend_execute (zend_vm_execute.h:458) ==18213== by 0x800092: zend_execute_scripts (zend.c:1427) ==18213== by 0x7A15E7: php_execute_script (main.c:2494) ==18213== by 0x88AB27: do_cli (php_cli.c:974) ==18213== by 0x453E79: main (php_cli.c:1344) ==18213== Address 0x27f4a9a0 is 16 bytes inside a block of size 48 free'd ==18213== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==18213== by 0x83ADC9: zend_objects_store_del (zend_objects_API.c:187) ==18213== by 0x887782: UnknownInlinedFun (zend_execute.c:2067) ==18213== by 0x887782: zend_leave_helper_SPEC (zend_vm_execute.h:470) ==18213== by 0x83EDDA: execute_ex (zend_vm_execute.h:414) ==18213== by 0x888EB6: zend_execute (zend_vm_execute.h:458) ==18213== by 0x800092: zend_execute_scripts (zend.c:1427) ==18213== by 0x7A15E7: php_execute_script (main.c:2494) ==18213== by 0x88AB27: do_cli (php_cli.c:974) ==18213== by 0x453E79: main (php_cli.c:1344) ==18213== ==18213== Invalid read of size 1 ==18213== at 0x628332: pdo_mysql_stmt_dtor (mysql_statement.c:92) ==18213== by 0x624749: php_pdo_free_statement (pdo_stmt.c:2323) ==18213== by 0x83AFB0: zend_objects_store_del (zend_objects_API.c:178) ==18213== by 0x61C27F: pdo_dbh_attribute_set (pdo_dbh.c:805) ==18213== by 0x61C932: zim_PDO_dbh_constructor (pdo_dbh.c:385) ==18213== by 0x87D39A: ZEND_DO_FCALL_SPEC_HANDLER (zend_vm_execute.h:842) ==18213== by 0x83EDDA: execute_ex (zend_vm_execute.h:414) ==18213== by 0x888EB6: zend_execute (zend_vm_execute.h:458) ==18213== by 0x800092: zend_execute_scripts (zend.c:1427) ==18213== by 0x7A15E7: php_execute_script (main.c:2494) ==18213== by 0x88AB27: do_cli (php_cli.c:974) ==18213== by 0x453E79: main (php_cli.c:1344) ==18213== Address 0x27f4a99d is 13 bytes inside a block of size 48 free'd ==18213== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==18213== by 0x83ADC9: zend_objects_store_del (zend_objects_API.c:187) ==18213== by 0x887782: UnknownInlinedFun (zend_execute.c:2067) ==18213== by 0x887782: zend_leave_helper_SPEC (zend_vm_execute.h:470) ==18213== by 0x83EDDA: execute_ex (zend_vm_execute.h:414) ==18213== by 0x888EB6: zend_execute (zend_vm_execute.h:458) ==18213== by 0x800092: zend_execute_scripts (zend.c:1427) ==18213== by 0x7A15E7: php_execute_script (main.c:2494) ==18213== by 0x88AB27: do_cli (php_cli.c:974) ==18213== by 0x453E79: main (php_cli.c:1344) ==18213== Statement failed ==18213== Invalid read of size 4 ==18213== at 0x628322: pdo_mysql_stmt_dtor (mysql_statement.c:91) ==18213== by 0x624749: php_pdo_free_statement (pdo_stmt.c:2323) ==18213== by 0x83ABE0: zend_objects_store_free_object_storage (zend_objects_API.c:99) ==18213== by 0x7F0F12: shutdown_executor (zend_execute_API.c:357) ==18213== by 0x7FFD37: zend_deactivate (zend.c:967) ==18213== by 0x7A01C0: php_request_shutdown (main.c:1833) ==18213== by 0x889CD7: do_cli (php_cli.c:1141) ==18213== by 0x453E79: main (php_cli.c:1344) ==18213== Address 0x27f50160 is 16 bytes inside a block of size 48 free'd ==18213== at 0x4C2AD17: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==18213== by 0x83ADC9: zend_objects_store_del (zend_objects_API.c:187) ==18213== by 0x887782: UnknownInlinedFun (zend_execute.c:2067) ==18213== by 0x887782: zend_leave_helper_SPEC (zend_vm_execute.h:470) ==18213== by 0x83EDDA: execute_ex (zend_vm_execute.h:414) ==18213== by 0x888EB6: zend_execute (zend_vm_execute.h:458) ==18213== by 0x800092: zend_execute_scripts (zend.c:1427) ==18213== by 0x7A15E7: php_execute_script (main.c:2494) ==18213== by 0x88AB27: do_cli (php_cli.c:974) ==18213== by 0x453E79: main (php_cli.c:1344) Test script: --------------- <?php function test1() { $dsn = "mysql:host=127.0.0.1;port=3306;dbname=test;"; $user = "root"; $attr = array( PDO::ATTR_TIMEOUT => 120, PDO::ATTR_PERSISTENT => true ); $pdo = new PDO($dsn, $user, NULL, $attr); $stmt = $pdo->query("SELECT 1 FROM DOES_NOT_EXIST"); if ($stmt === false) { echo "Statement failed\n"; } } test1(); test1(); Expected result: ---------------- No segfaults -- Edit bug report at https://bugs.php.net/bug.php?id=72788&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72788&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72788&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72788&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72788&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72788&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72788&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72788&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72788&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72788&r=support Expected behavior: https://bugs.php.net/fix.php?id=72788&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72788&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72788&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72788&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72788&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72788&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72788&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72788&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72788&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72788&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72788&r=mysqlcfg