PHP 4.0 Bug #6215 Updated: php core dumps on selects with blob columns

ID: 6215 Updated by: danny Reported By: helmut.koeberle@bytec.de Status: Closed Bug Type: Informix related Assigned To: danny Comments: Fixed the crash caused by the invalid free() in the current CVS, but you will still have to find out why tempnam() fails on your system. Danny --- Previous Comments: [2000-09-04 17:01:54] danny@php.net It is caused by the "tempnam()" function that fails for some reason or other and the return value is not checked so that free gets called with NULL as argument. I don't know why tempnam() fails on you but not checking the return value of tempnam() is a bug that will be fixed. Danny --- --------------------------------------------------------------------------- [2000-08-17 09:49:15] helmut.koeberle@bytec.de ./configure --prefix=/usr --with-informix --without-mysql --enable-debug example script: <?php $cid = ifx_connect("php_tests"); if (! $cid) { ifx_error(); ifx_errormsg(); die; } //ifx_blobinfile_mode(0); ifx_blobinfile_mode(1); $rid = ifx_prepare("select doc from xxx", $cid); if (! $rid) { ifx_error(); ifx_errormsg(); die; } if (! ifx_do($rid)) { ifx_error(); ifx_errormsg(); die; } $row = ifx_fetch_row($rid); $blob = ifx_get_blob($row["doc"]); ifx_free_blob($blob); ifx_free_result($rid); ifx_close($cid); ?> gdb backtrace: #0 0x4023ef93 in __libc_free (mem=0x80e964d) at malloc.c:3012 3012 malloc.c: No such file or directory. (gdb) bt #0 0x4023ef93 in __libc_free (mem=0x80e964d) at malloc.c:3012 #1 0x806ffa5 in php3_intifx_create_tmpfile (bid=1) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3713 #2 0x806d186 in php_if_ifx_do (ht=1, return_value=0x8151614, this_ptr=0x0, return_value_used=1) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:1661 #3 0x80e08f9 in execute (op_array=0x8132604) at ./zend_execute.c:1558 #4 0x805d7cb in php_execute_script (primary_file=0xbffffa44) at main.c:1157 #5 0x805c1c9 in main (argc=2, argv=0xbffffaa4) at cgi_main.c:661 (gdb) with ifx_blobinfile_mode(0) the error goes to: #0 0x806fb58 in php3_intifx_free_blob (bid=0, list=0x812b138) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3429 3429 if (type!=IFXL(le_idresult) && !(Ifx_blob->type==TYPE_BLTEXT || Ifx_blob->type==TYPE_BLBYTE)) { (gdb) bt #0 0x806fb58 in php3_intifx_free_blob (bid=0, list=0x812b138) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3429 #1 0x806fb17 in php_if_ifx_free_blob (ht=1, return_value=0x818872c, this_ptr=0x0, return_value_used=0) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3402 #2 0x80e08f9 in execute (op_array=0x8132604) at ./zend_execute.c:1558 #3 0x805d7cb in php_execute_script (primary_file=0xbffffa34) at main.c:1157 #4 0x805c1c9 in main (argc=2, argv=0xbffffa94) at cgi_main.c:661 (gdb) if i convert some of the free-statements in php3_intifx_create_tmpfile() to efree-statements, then the blob is stored in a tempfile, but php also dumps core in php3_intifx_free_blob(). --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6215