Bug #72862 [Opn->Csd]: segfault using prepared statements on stored procedures that use a cursor

From: Date: Fri, 18 Dec 2020 09:27:23 +0000
Subject: Bug #72862 [Opn->Csd]: segfault using prepared statements on stored procedures that use a cursor
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-231143@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=72862&edit=1

 ID:                 72862
 Updated by:         nikic@php.net
 Reported by:        nuke48386 at yahoo dot com
 Summary:            segfault using prepared statements on stored
                     procedures that use a cursor
-Status:             Open
+Status:             Closed
 Type:               Bug
 Package:            MySQLi related
 Operating System:   Debian Wheezy i686
 PHP Version:        5.6.24
-Assigned To:        
+Assigned To:        nikic
 Block user comment: N
 Private report:     N

 New Comment:

This should be fixed by https://github.com/php/php-src/commit/bc166844e37a6e1531a18dc0916fbe508152fc6c.


Previous Comments:
------------------------------------------------------------------------
[2016-09-30 11:53:01] richard dot fussenegger at trivago dot com

Possible duplicate of https://bugs.php.net/bug.php?id=72413

------------------------------------------------------------------------
[2016-08-17 04:19:53] nuke48386 at yahoo dot com

Description:
------------
A prepared statement that calls a stored procedure that uses a cursor causes the PHP process to
segfault.
The issue is in the mysqlnd module.


Test script:
---------------
I have posted an SQL file for creating a test database and stored procedure,
and a PHP script that together can reproduce the bug.
Together they are more than 20 lines, so they can be found in
the issue I opened with the folks at DotDeb:
https://github.com/gplessis/dotdeb-php/issues/145

Actual result:
--------------
backtrace:
Starting program: /usr/bin/php test.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
mysqlnd_fetch_stmt_row_cursor (result=0xb7621088, param=0xb7621a64, flags=2,
fetched_anything=0xbfffba3f "\267\364/3\267\210\020b\267")
    at /usr/src/builddir/ext/mysqlnd/mysqlnd_ps.c:1022
1022    /usr/src/builddir/ext/mysqlnd/mysqlnd_ps.c: No such file or directory.
#0  mysqlnd_fetch_stmt_row_cursor (result=0xb7621088, param=0xb7621a64, flags=2,
fetched_anything=0xbfffba3f "\267\364/3\267\210\020b\267")
    at /usr/src/builddir/ext/mysqlnd/mysqlnd_ps.c:1022
#1  0xb73148d5 in php_mysqlnd_res_fetch_row_pub (result=0xb7621088, param=0xb7621a64, flags=2,
fetched_anything=0xbfffba3f "\267\364/3\267\210\020b\267")
    at /usr/src/builddir/ext/mysqlnd/mysqlnd_result.c:1352
#2  0xb73173a6 in php_mysqlnd_res_fetch_into_pub (result=0xb7621088, flags=2,
return_value=0xb7621a64, extension=MYSQLND_MYSQLI)
    at /usr/src/builddir/ext/mysqlnd/mysqlnd_result.c:1823
#3  0xb73171c5 in php_mysqlnd_res_fetch_all_pub (result=0xb7621088, flags=2,
return_value=0xb7621a48) at /usr/src/builddir/ext/mysqlnd/mysqlnd_result.c:1893
#4  0xb67c6132 in zif_mysqli_fetch_all (ht=0, return_value=0xb7621a48, return_value_ptr=0xb76041a0,
this_ptr=0xb761edb0, return_value_used=1)
    at /usr/src/builddir/ext/mysqli/mysqli_nonapi.c:385
#5  0x0842d376 in execute_internal (execute_data_ptr=execute_data_ptr@entry=0xb76042bc,
fci=fci@entry=0x0, return_value_used=return_value_used@entry=1)
    at /usr/src/builddir/Zend/zend_execute.c:1527
#6  0x08371493 in dtrace_execute_internal (execute_data_ptr=0xb76042bc, fci=0x0,
return_value_used=1) at /usr/src/builddir/Zend/zend_dtrace.c:97
#7  0x0842f9e7 in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at
/usr/src/builddir/Zend/zend_vm_execute.h:560
#8  0x083f15e7 in execute_ex (execute_data=execute_data@entry=0xb76042bc) at
/usr/src/builddir/Zend/zend_vm_execute.h:363
#9  0x08371359 in dtrace_execute_ex (execute_data=0xb76042bc) at
/usr/src/builddir/Zend/zend_dtrace.c:73
#10 0x0842f162 in zend_execute (op_array=0xb761e5a4) at /usr/src/builddir/Zend/zend_vm_execute.h:388
#11 zend_execute (op_array=0xb761e5a4) at /usr/src/builddir/Zend/zend_vm_execute.h:383
#12 0x08384906 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0,
file_count=file_count@entry=3) at /usr/src/builddir/Zend/zend.c:1341
#13 0x08319dae in php_execute_script (primary_file=primary_file@entry=0xbfffdf78) at
/usr/src/builddir/main/main.c:2613
#14 0x08433379 in do_cli (argc=-1073750152, argc@entry=2, argv=0x7, argv@entry=0x89a0d88) at
/usr/src/builddir/sapi/cli/php_cli.c:994
#15 0x080a5f43 in main (argc=2, argv=0x89a0d88) at /usr/src/builddir/sapi/cli/php_cli.c:1378
A debugging session is active.

        Inferior 1 [process 4588] will be killed.

Quit anyway? (y or n)


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=72862&edit=1

Thread (3 messages)

« previous php.bugs (#231143) next »