PHP 4.0 Bug #6215 Updated: php core dumps on selects with blob columns

ID: 6215 Updated by: danny Reported By: helmut.koeberle@bytec.de Status: Analyzed Bug Type: Informix related Assigned To: danny Comments: It is caused by the "tempnam()" function that fails for some reason or other and the return value is not checked so that free gets called with NULL as argument. I don't know why tempnam() fails on you but not checking the return value of tempnam() is a bug that will be fixed. Danny --- Previous Comments: [2000-08-17 09:49:15] helmut.koeberle@bytec.de ./configure --prefix=/usr --with-informix --without-mysql --enable-debug example script: <?php $cid = ifx_connect("php_tests"); if (! $cid) { ifx_error(); ifx_errormsg(); die; } //ifx_blobinfile_mode(0); ifx_blobinfile_mode(1); $rid = ifx_prepare("select doc from xxx", $cid); if (! $rid) { ifx_error(); ifx_errormsg(); die; } if (! ifx_do($rid)) { ifx_error(); ifx_errormsg(); die; } $row = ifx_fetch_row($rid); $blob = ifx_get_blob($row["doc"]); ifx_free_blob($blob); ifx_free_result($rid); ifx_close($cid); ?> gdb backtrace: #0 0x4023ef93 in __libc_free (mem=0x80e964d) at malloc.c:3012 3012 malloc.c: No such file or directory. (gdb) bt #0 0x4023ef93 in __libc_free (mem=0x80e964d) at malloc.c:3012 #1 0x806ffa5 in php3_intifx_create_tmpfile (bid=1) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3713 #2 0x806d186 in php_if_ifx_do (ht=1, return_value=0x8151614, this_ptr=0x0, return_value_used=1) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:1661 #3 0x80e08f9 in execute (op_array=0x8132604) at ./zend_execute.c:1558 #4 0x805d7cb in php_execute_script (primary_file=0xbffffa44) at main.c:1157 #5 0x805c1c9 in main (argc=2, argv=0xbffffaa4) at cgi_main.c:661 (gdb) with ifx_blobinfile_mode(0) the error goes to: #0 0x806fb58 in php3_intifx_free_blob (bid=0, list=0x812b138) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3429 3429 if (type!=IFXL(le_idresult) && !(Ifx_blob->type==TYPE_BLTEXT || Ifx_blob->type==TYPE_BLBYTE)) { (gdb) bt #0 0x806fb58 in php3_intifx_free_blob (bid=0, list=0x812b138) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3429 #1 0x806fb17 in php_if_ifx_free_blob (ht=1, return_value=0x818872c, this_ptr=0x0, return_value_used=0) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3402 #2 0x80e08f9 in execute (op_array=0x8132604) at ./zend_execute.c:1558 #3 0x805d7cb in php_execute_script (primary_file=0xbffffa34) at main.c:1157 #4 0x805c1c9 in main (argc=2, argv=0xbffffa94) at cgi_main.c:661 (gdb) if i convert some of the free-statements in php3_intifx_create_tmpfile() to efree-statements, then the blob is stored in a tempfile, but php also dumps core in php3_intifx_free_blob(). --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6215