PHP 4.0 Bug #6215 Updated: php core dumps on selects with blob columns

ID: 6215 User Update by: helmut.koeberle@bytec.de Old-Status: Closed Status: Open Bug Type: Informix related Description: php core dumps on selects with blob columns Changed to Version 4.0.3pl1 with the following error: Program received signal SIGSEGV, Segmentation fault. 0x8087cbf in php3_intifx_get_blob (bid=0, list=0x81dc084, content=0xbfffe198) at /ali1/btc/src/apache/php-4.0.3pl1/ext/informix/ifx.ec:3622 3622 if (type!=IFXL(le_idresult) && !(Ifx_blob->type==TYPE_BLTEXT || Ifx_blob->type==TYPE_BLBYTE)) { (gdb) bt #0 0x8087cbf in php3_intifx_get_blob (bid=0, list=0x81dc084, content=0xbfffe198) at /ali1/btc/src/apache/php-4.0.3pl1/ext/informix/ifx.ec:3622 #1 0x8087c40 in php_if_ifx_get_blob (ht=1, return_value=0x823b96c, this_ptr=0x0, return_value_used=1) at /ali1/btc/src/apache/php-4.0.3pl1/ext/informix/ifx.ec:3594 #2 0x80fc9ec in execute (op_array=0x82084fc) at ./zend_execute.c:1519 #3 0x80d9bf8 in zend_execute_scripts (type=8, file_count=3) at zend.c:717 #4 0x8068821 in php_execute_script (primary_file=0xbffff854) at main.c:1200 #5 0x80671b9 in main (argc=2, argv=0xbffff8b4) at cgi_main.c:715 Previous Comments: --------------------------------------------------------------------------- [2000-09-04 17:20:20] danny@php.net Fixed the crash caused by the invalid free() in the current CVS, but you will still have to find out why tempnam() fails on your system. Danny --- --------------------------------------------------------------------------- [2000-09-04 17:01:54] danny@php.net It is caused by the "tempnam()" function that fails for some reason or other and the return value is not checked so that free gets called with NULL as argument. I don't know why tempnam() fails on you but not checking the return value of tempnam() is a bug that will be fixed. Danny --- --------------------------------------------------------------------------- [2000-08-17 09:49:15] helmut.koeberle@bytec.de ./configure --prefix=/usr --with-informix --without-mysql --enable-debug example script: <?php $cid = ifx_connect("php_tests"); if (! $cid) { ifx_error(); ifx_errormsg(); die; } //ifx_blobinfile_mode(0); ifx_blobinfile_mode(1); $rid = ifx_prepare("select doc from xxx", $cid); if (! $rid) { ifx_error(); ifx_errormsg(); die; } if (! ifx_do($rid)) { ifx_error(); ifx_errormsg(); die; } $row = ifx_fetch_row($rid); $blob = ifx_get_blob($row["doc"]); ifx_free_blob($blob); ifx_free_result($rid); ifx_close($cid); ?> gdb backtrace: #0 0x4023ef93 in __libc_free (mem=0x80e964d) at malloc.c:3012 3012 malloc.c: No such file or directory. (gdb) bt #0 0x4023ef93 in __libc_free (mem=0x80e964d) at malloc.c:3012 #1 0x806ffa5 in php3_intifx_create_tmpfile (bid=1) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3713 #2 0x806d186 in php_if_ifx_do (ht=1, return_value=0x8151614, this_ptr=0x0, return_value_used=1) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:1661 #3 0x80e08f9 in execute (op_array=0x8132604) at ./zend_execute.c:1558 #4 0x805d7cb in php_execute_script (primary_file=0xbffffa44) at main.c:1157 #5 0x805c1c9 in main (argc=2, argv=0xbffffaa4) at cgi_main.c:661 (gdb) with ifx_blobinfile_mode(0) the error goes to: #0 0x806fb58 in php3_intifx_free_blob (bid=0, list=0x812b138) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3429 3429 if (type!=IFXL(le_idresult) && !(Ifx_blob->type==TYPE_BLTEXT || Ifx_blob->type==TYPE_BLBYTE)) { (gdb) bt #0 0x806fb58 in php3_intifx_free_blob (bid=0, list=0x812b138) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3429 #1 0x806fb17 in php_if_ifx_free_blob (ht=1, return_value=0x818872c, this_ptr=0x0, return_value_used=0) at /tmp/php-4.0.1pl2/ext/informix/ifx.ec:3402 #2 0x80e08f9 in execute (op_array=0x8132604) at ./zend_execute.c:1558 #3 0x805d7cb in php_execute_script (primary_file=0xbffffa34) at main.c:1157 #4 0x805c1c9 in main (argc=2, argv=0xbffffa94) at cgi_main.c:661 (gdb) if i convert some of the free-statements in php3_intifx_create_tmpfile() to efree-statements, then the blob is stored in a tempfile, but php also dumps core in php3_intifx_free_blob(). --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6215