#34953 [NEW]: Segfault when doing weird MySQL query

From: juraj dot nospam at bednar dot sk Operating system: Debian Sarge PHP version: 5CVS-2005-10-22 (snap) PHP Bug Type: MySQL related Bug description: Segfault when doing weird MySQL query Description: ------------ When doing an SQL query (which had errors), I get segfault with apache 2.0.55 prefork, mysql 5.0.5 from debian testing (ldd shows it's linked with correct library) using legacy code (old version of drupal). While legacy code does not have to work, segfault when running it is not expected Reproduce code: --------------- INSERT INTO watchdog (uid, type, message, location, hostname, timestamp) VALUES (\'\', \'error\', \'warning: array_merge() [<a href=\\\'function.array-merge\\\'>function.array-merge</a>]: Argument #1 is not an array in /home/juraj/www/includes/common.inc on line 710.\', \'?\', \'82.100.100.200\', \'1129942132\') causes php child to segfault Expected result: ---------------- i did not expect it to actually execute, but the segfault is wrong behaviour. Actual result: -------------- This is a part of strace, which shows the problem. 28 is mysql socket. Another queries work well. [pid 3442] time(NULL) = 1129942132 [pid 3442] fcntl64(28, F_SETFL, O_RDWR|O_NONBLOCK) = 0 [pid 3442] read(28, 0x83b47c8, 8192) = -1 EAGAIN (Resource temporarily unavailable) [pid 3442] fcntl64(28, F_SETFL, O_RDWR) = 0 [pid 3442] write(28, ":\1\0\0\3INSERT INTO watchdog (uid, type, message, location, hostname, timestamp) VALUES (\'\', \'error\', \'warning: array_merge() [<a href=\\ \'function.array-merge\\\'>function.array-merge</a>]: Argument #1 is not an array in /home/juraj/www/includes/ common.inc on line 710.\', \'?\', \'82.100.100.200\', \'1129942132\')", 318) = 318 [pid 3442] read(28, "\7\0\0\1\0\1\33\2\0\1\0", 16384) = 11 [pid 3442] --- SIGSEGV (Segmentation fault) @ 0 (0) --- [pid 3442] chdir("/usr/local/apache2") = 0 [pid 3442] rt_sigaction(SIGSEGV, {SIG_DFL}, {SIG_DFL}, 8) = 0 [pid 3442] getpid() = 3442 [pid 3442] getpid() = 3442 [pid 3442] kill(3442, SIGSEGV) = 0 [pid 3442] sigreturn() = ? (mask now [RTMIN]) [pid 3442] --- SIGSEGV (Segmentation fault) @ 0 (0) --- -- Edit bug report at http://bugs.php.net/?id=34953&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=34953&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=34953&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=34953&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=34953&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=34953&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=34953&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=34953&r=needscript Try newer version: http://bugs.php.net/fix.php?id=34953&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=34953&r=support Expected behavior: http://bugs.php.net/fix.php?id=34953&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=34953&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=34953&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=34953&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=34953&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=34953&r=dst IIS Stability: http://bugs.php.net/fix.php?id=34953&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=34953&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=34953&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=34953&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=34953&r=mysqlcfg