Bug #73800 [NEW]: Sporadic segfault in mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE enabled

From: php at vanviegen dot net Operating system: PHP version: 7.0.14 Package: MySQLi related Bug Type: Bug Bug description:Sporadic segfault in mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE enabled Description: ------------ The segfault happens sporadically, usually when reading large amounts of data. The backtrace is instructive: #0 php_mysqlnd_rowp_read_text_protocol_aux (row_buffer=<optimized out>, fields=<optimized out>, field_count=<optimized out>, fields_metadata=0x7fa0dd9c5e20, as_int_or_float=1 '\001', stats=0x7fa0dd95c460) at /usr/src/builddir/ext/mysqlnd/mysqlnd_wireprotocol.c:1674 #1 0x00007fa0d97a6239 in php_mysqlnd_result_buffered_zval_fetch_row_pub ( result=<optimized out>, param=0x7fa0d9c146b0, flags=2, fetched_anything=0x7ffebc5139a7 "") at /usr/src/builddir/ext/mysqlnd/mysqlnd_result.c:1078 #2 0x00007fa0d97a6705 in php_mysqlnd_res_fetch_into_pub (result=0x7fa0dd9c4500, flags=2, return_value=0x7fa0d9c146b0, extension=MYSQLND_MYSQLI) at /usr/src/builddir/ext/mysqlnd/mysqlnd_result.c:1727 #3 0x00007fa0cfd044e7 in php_mysqli_fetch_into_hash (execute_data=0x7ffebc5138e0, return_value=0x7fa0d9c146b0, override_flags=0, into_object=0) at /usr/src/builddir/ext/mysqli/mysqli.c:1275 #4 0x00007fa0dc0b7726 in ZEND_DO_FCALL_SPEC_HANDLER () at /usr/src/builddir/Zend/zend_vm_execute.h:842 [...] Which resolves to the second line of this code fragment of ext/mysqlnd/mysqlnd_wireprotocol.c: if (as_int_or_float && perm_bind.php_type == IS_LONG) { zend_uchar save = *(p + len); /* We have to make it ASCIIZ temporarily */ *(p + len) = '\0'; So when a row ends with a long (or a float), this writes past the end of the row_buffer. As the old value is restored later on in this function, this is usually not a problem. Unless of course it happens to access unmapped address space. Test script: --------------- This bug seems rather impossible to reproduce deterministically, sorry! -- Edit bug report at https://bugs.php.net/bug.php?id=73800&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73800&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73800&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73800&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73800&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73800&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73800&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73800&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73800&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73800&r=support Expected behavior: https://bugs.php.net/fix.php?id=73800&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73800&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73800&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73800&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73800&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73800&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73800&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73800&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73800&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73800&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73800&r=mysqlcfg