Bug #78192 [Ver]: SegFault when reuse statement after schema has changed
Edit report at https://bugs.php.net/bug.php?id=78192&edit=1
ID: 78192
Updated by: cmb@php.net
Reported by: stanneux at b2pweb dot com
Summary: SegFault when reuse statement after schema has
changed
Status: Verified
Type: Bug
Package: PDO SQLite
Operating System: linux Fedora
PHP Version: 7.2.19
Block user comment: N
Private report: N
New Comment:
Stack backtrace:
php7ts_debug.dll!zend_string_release_ex(_zend_string * s, int persistent) Line 284
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_string.h:284)
php7ts_debug.dll!php_pdo_free_statement(_pdo_stmt_t * stmt) Line 2333
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\ext\pdo\pdo_stmt.c:2333)
php7ts_debug.dll!pdo_dbstmt_free_storage(_zend_object * std) Line 2357
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\ext\pdo\pdo_stmt.c:2357)
php7ts_debug.dll!zend_objects_store_del(_zend_object * object) Line 191
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_objects_API.c:191)
php7ts_debug.dll!zend_object_destroy_wrapper(_zend_object * obj) Line 96
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_variables.c:96)
php7ts_debug.dll!rc_dtor_func(_zend_refcounted * p) Line 66
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_variables.c:66)
php7ts_debug.dll!i_zval_ptr_dtor(_zval_struct * zval_ptr, const char * __zend_filename, const
unsigned int __zend_lineno) Line 45
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_variables.h:45)
php7ts_debug.dll!zval_ptr_dtor(_zval_struct * zval_ptr) Line 112
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_variables.c:112)
php7ts_debug.dll!_zend_hash_del_el_ex(_zend_array * ht, unsigned int idx, _Bucket * p, _Bucket *
prev) Line 1183 (c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_hash.c:1183)
php7ts_debug.dll!_zend_hash_del_el(_zend_array * ht, unsigned int idx, _Bucket * p) Line 1206
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_hash.c:1206)
php7ts_debug.dll!zend_hash_reverse_apply(_zend_array * ht, int(*)(_zval_struct *) apply_func) Line
1778 (c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_hash.c:1778)
php7ts_debug.dll!shutdown_destructors() Line 241
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend_execute_API.c:241)
php7ts_debug.dll!zend_call_destructors() Line 1090
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\Zend\zend.c:1090)
php7ts_debug.dll!php_request_shutdown(void * dummy) Line 1878
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\main\main.c:1878)
php.exe!do_cli(int argc, char * * argv) Line 1166
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\sapi\cli\php_cli.c:1166)
php.exe!main(int argc, char * * argv) Line 1389
(c:\php-sdk\phpdev\vc15\x64\php-src-7.3\sapi\cli\php_cli.c:1389)
php.exe!invoke_main() Line 79
(d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:79)
php.exe!__scrt_common_main_seh() Line 288
(d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
php.exe!__scrt_common_main() Line 331
(d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:331)
php.exe!mainCRTStartup() Line 17
(d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:17)
It seems that after the ALTER TABLE statement, stmt->column_count is updated, but
stmt->columns not. The resulting OOB read should be indicated by a memory checker.
Previous Comments:
------------------------------------------------------------------------
[2019-06-21 09:41:07] sjon@php.net
this has some interesting behaviour - 7.1 (still) throws a correct exception, 7.2 fails silently and
7.3 / 7.4 segfault
------------------------------------------------------------------------
[2019-06-21 09:23:27] stanneux at b2pweb dot com
Description:
------------
This bug occurs on php 7.2.0 and it is not fixed in v7.3.6. The test script has been launched on
docker image php:7.2-cli and php:7.3-cli
The test case fail with pdo_sqlite but works fine with SQLite3
No changes set on docker images. The php.ini file is the same.
Test script:
---------------
<?php
$connection = new \PDO('sqlite::memory:');
$connection->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
$connection->query('CREATE TABLE user (id INTEGER PRIMARY KEY NOT NULL, name VARCHAR(255)
NOT NULL)');
$stmt = $connection->prepare('INSERT INTO user (id, name) VALUES(:id, :name)');
$stmt->execute([
'id' => 10,
'name' => 'test',
]);
$stmt = $connection->prepare('SELECT * FROM user WHERE id = :id');
$stmt->execute(['id' => 10]);
$stmt->fetchAll(\PDO::FETCH_ASSOC);
$connection->query('ALTER TABLE user ADD new_col VARCHAR(255)');
$stmt->execute(['id' => 10]); // SegFault here
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=78192&edit=1
Thread (5 messages)