Bug #75927 [NEW]: Crash when using subquery which returns more than 1 row
From: s dot pfalz at webcookies dot de
Operating system: Fedora 27
PHP version: 7.0.27
Package: MySQLi related
Bug Type: Bug
Bug description:Crash when using subquery which returns more than 1 row
Description:
------------
When executing the code below PHP-FPM interpreter crashes with sigsegv
and dumps core.
The problem is related to the subquery, which should normally return
only 1 row, but in my case it would return 2 rows, which of course
cannot work and I expected an error code: "Error Code: 1242. Subquery
returns more than 1 row".
However i got a crash (503 Service unavailable) and a coredump was
written.
Test script:
---------------
<?php
$mysqli = new mysqli("localhost","xyz","xyz_2k17","xyz");
if($mysqli->connect_errno)
{
die("Cannot connect: ".$mysqli->connect_error);
}
$SQL=<<<EOM
SELECT bc.ID AS BOOKING_CUSTOMER_ID,
bc.REF_ORDER_ID,
bc.BOOKING_NUMBER,
bc.STATUS,
UNIX_TIMESTAMP(bc.PAYMENT_DATE) AS BOOKING_PAYMENT_DATE,
bc.PAYMENT_SUM,
bc.BOOKING_STATUS,
bc.BOOKING_STATUS_CODE,
bc.BOOKING_MESSAGE,
bc.TRANSACTION_ID,
UNIX_TIMESTAMP(bc.BOOKING_DATE) AS BC_BOOKING_DATE,
UNIX_TIMESTAMP(EXECUTION_DATE) AS BC_EXECUTION_DATE,
UNIX_TIMESTAMP(bc.CDATE) AS BOOKING_CUSTOMER_CDATE,
UNIX_TIMESTAMP(bc.MDATE) AS BOOKING_CUSTOMER_MDATE,
(SELECT PAYMENT_SUM+PENALTY_FEE+PROCESSING_FEE+LAWYER_FEE FROM
xyz_failed_payments fp WHERE fp.REF_BOOKING_ID=bc.ID) AS PAYMENT_FEE
FROM xyz_order_booking_customer bc
WHERE bc.REF_ORDER_ID=?
ORDER BY bc.BOOKING_NUMBER
EOM;
if(!($stmt = $mysqli->prepare($SQL)))
{
die("PREPARE FAILED: ".$mysqli->error);
}
$id = 9;
if(!$stmt->bind_param("i",$id))
{
die("Binding failed: ".$stmt->error);
}
if(!$stmt->execute())
{
die("Execute failed! ".$stmt->error);
}
Expected result:
----------------
Execute should give an error:
Error Code: 1242. Subquery returns more than 1 row
Actual result:
--------------
Segmentation fault (core dumped)
Backtrace:
#0 0x00000000008ebdd0 in php_mysqlnd_stmt_fetch_pub ()
#1 0x00007fb77d479188 in ?? ()
#2 0x00007ffc0bbbd71f in ?? ()
#3 0x0000000001329e60 in m_sbox ()
#4 0x0000000000000001 in ?? ()
#5 0x00007fb77d487008 in ?? ()
#6 0x00007ffc0bbbda00 in ?? ()
#7 0x00000000008e47c4 in php_mysqlnd_result_buffered_num_rows_pub ()
#8 0x00007fb77d46c248 in ?? ()
#9 0x00007fb77d487008 in ?? ()
#10 0x00007fb77d472148 in ?? ()
#11 0x00007fb77d487008 in ?? ()
#12 0x00007fb77d46d008 in ?? ()
#13 0x00000000008ea263 in php_mysqlnd_debug_set_mode_pub ()
#14 0x18ac670d3c77163f in ?? ()
#15 0x0000000000000000 in ?? ()
--
Edit bug report at https://bugs.php.net/bug.php?id=75927&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75927&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75927&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75927&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=75927&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=75927&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=75927&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=75927&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=75927&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=75927&r=support
Expected behavior: https://bugs.php.net/fix.php?id=75927&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=75927&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=75927&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=75927&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75927&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=75927&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=75927&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=75927&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=75927&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=75927&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=75927&r=mysqlcfg
Thread (4 messages)
- s dot pfalz at webcookies dot de