Bug #75927 [Opn]: Crash when using subquery which returns more than 1 row
Edit report at https://bugs.php.net/bug.php?id=75927&edit=1
ID: 75927
User updated by: s dot pfalz at webcookies dot de
Reported by: s dot pfalz at webcookies dot de
Summary: Crash when using subquery which returns more than 1
row
Status: Open
Type: Bug
Package: MySQLi related
Operating System: Fedora 27
PHP Version: 7.0.27
Block user comment: N
Private report: N
New Comment:
Sorry, backtrace was against php-fpm, but I've tested on CLI :(
Here's the correct trace:
0 0x00000000008ebdd0 in mysqlnd_stmt_fetch_row_unbuffered ()
#1 0x00000000008e47c4 in php_mysqlnd_res_skip_result_pub ()
#2 0x00000000008ea263 in php_mysqlnd_stmt_net_close_priv ()
#3 0x00000000008e97be in php_mysqlnd_stmt_dtor_pub ()
#4 0x0000000000720c6f in mysqli_stmt_free_storage ()
#5 0x000000000099dfaa in zend_objects_store_del ()
#6 0x00000000009700f1 in zend_hash_reverse_apply ()
#7 0x000000000094d7ed in shutdown_destructors ()
#8 0x000000000095e7a4 in zend_call_destructors ()
#9 0x00000000008f300d in php_request_shutdown ()
#10 0x0000000000a0657a in do_cli ()
#11 0x000000000045000b in main ()
Previous Comments:
------------------------------------------------------------------------
[2018-02-06 15:29:31] s dot pfalz at webcookies dot de
Description:
------------
When executing the code below PHP-FPM interpreter crashes with sigsegv and dumps core.
The problem is related to the subquery, which should normally return only 1 row, but in my case it
would return 2 rows, which of course cannot work and I expected an error code: "Error Code:
1242. Subquery returns more than 1 row".
However i got a crash (503 Service unavailable) and a coredump was written.
Test script:
---------------
<?php
$mysqli = new mysqli("localhost","xyz","xyz_2k17","xyz");
if($mysqli->connect_errno)
{
die("Cannot connect: ".$mysqli->connect_error);
}
$SQL=<<<EOM
SELECT bc.ID AS BOOKING_CUSTOMER_ID,
bc.REF_ORDER_ID,
bc.BOOKING_NUMBER,
bc.STATUS,
UNIX_TIMESTAMP(bc.PAYMENT_DATE) AS BOOKING_PAYMENT_DATE,
bc.PAYMENT_SUM,
bc.BOOKING_STATUS,
bc.BOOKING_STATUS_CODE,
bc.BOOKING_MESSAGE,
bc.TRANSACTION_ID,
UNIX_TIMESTAMP(bc.BOOKING_DATE) AS BC_BOOKING_DATE,
UNIX_TIMESTAMP(EXECUTION_DATE) AS BC_EXECUTION_DATE,
UNIX_TIMESTAMP(bc.CDATE) AS BOOKING_CUSTOMER_CDATE,
UNIX_TIMESTAMP(bc.MDATE) AS BOOKING_CUSTOMER_MDATE,
(SELECT PAYMENT_SUM+PENALTY_FEE+PROCESSING_FEE+LAWYER_FEE FROM xyz_failed_payments fp WHERE
fp.REF_BOOKING_ID=bc.ID) AS PAYMENT_FEE
FROM xyz_order_booking_customer bc
WHERE bc.REF_ORDER_ID=?
ORDER BY bc.BOOKING_NUMBER
EOM;
if(!($stmt = $mysqli->prepare($SQL)))
{
die("PREPARE FAILED: ".$mysqli->error);
}
$id = 9;
if(!$stmt->bind_param("i",$id))
{
die("Binding failed: ".$stmt->error);
}
if(!$stmt->execute())
{
die("Execute failed! ".$stmt->error);
}
Expected result:
----------------
Execute should give an error:
Error Code: 1242. Subquery returns more than 1 row
Actual result:
--------------
Segmentation fault (core dumped)
Backtrace:
#0 0x00000000008ebdd0 in php_mysqlnd_stmt_fetch_pub ()
#1 0x00007fb77d479188 in ?? ()
#2 0x00007ffc0bbbd71f in ?? ()
#3 0x0000000001329e60 in m_sbox ()
#4 0x0000000000000001 in ?? ()
#5 0x00007fb77d487008 in ?? ()
#6 0x00007ffc0bbbda00 in ?? ()
#7 0x00000000008e47c4 in php_mysqlnd_result_buffered_num_rows_pub ()
#8 0x00007fb77d46c248 in ?? ()
#9 0x00007fb77d487008 in ?? ()
#10 0x00007fb77d472148 in ?? ()
#11 0x00007fb77d487008 in ?? ()
#12 0x00007fb77d46d008 in ?? ()
#13 0x00000000008ea263 in php_mysqlnd_debug_set_mode_pub ()
#14 0x18ac670d3c77163f in ?? ()
#15 0x0000000000000000 in ?? ()
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=75927&edit=1
Thread (4 messages)