php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #9486 seems to be memory related
Submitted: 2001-02-27 15:16 UTC Modified: 2001-04-28 14:33 UTC
From: danielc at analysisandsolutions dot com Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0 Latest CVS (27/02/2001) OS: NT 4.0 SP 6a
Private report: No CVE-ID: None
 [2001-02-27 15:16 UTC] danielc at analysisandsolutions dot com
<?php

#  Hi:
#
#  Running PHP 4.0.5-dev Feb 20 2001
#  Windows NT 4.0 SP 6a
#  Apache 1.3.6
#  MySQL 3.23.32
#
#  The problem does not exist in 4.0.4-dev Nov 23 2000.
#
#  Problem arises when doing an isset() on a
#  a multidimensional array inside a function
#  that has that variable as an optional argument
#  but the argument hasn't been set, so it
#  defaults to ''.
#
#  But, it's not that simple.  Problem comes
#  and goes depending on how much memory is
#  being used.
#
#  Also, situation is only happening when
#  using results from mysql_field_name().
#
#  In addition, sometimes the page gets
#  created by PHP and sent to the browser,
#  but PHP crashes anyway.
#
#  I've already spent six hours trying to
#  pinpoint what's going on, though haven't
#  been able to hit the nail on the head yet.
#
#  Good luck.
#
#  --Dan


class Test {

   var $H = 'localhost';
   var $U = 'track';
   var $P = 'flight9';
   var $D = 'SessionTracker';


   function Setup() {
      $this->C = @mysql_connect("$this->H", "$this->U", "$this->P");
      $this->Hand = @mysql_select_db("$this->D", $this->C);
      $this->Res = @mysql_query("$this->Query",$this->C);
      $this->Cols = @mysql_num_fields($this->Res);
   }


   function FieldName($FileName,$FileLine,$ColNum) {
      if ( $Output = @mysql_field_name($this->Res, $ColNum) ) {
         return $Output;
      } else {
         echo "Field Name Had Problem";
      }
   }


   #  BEGIN ALTERNATIVE TEST FUNCTIONS HERE...

   # Uses MySQL data, but doesn't have the "$Col" argument.
   function Good() {
      for ($Count = 0; $Count < $this->Cols; $Count++) {
         $FieldNames[] = $this->FieldName('test','here', $Count);
         if ( !isset($Col[$FieldNames[$Count]]['hide']) ) {
            $VisibleFields++;
            echo "$Count = $FieldNames[$Count]. ";
         }
      }
   }


   # Doesn't use MySQL data, but uses "$Col" argument.
   function NoProblem($Col='') {
      for ($Count = 0; $Count < 3; $Count++) {
         $FieldNames[] = 'dog';
         $FieldNames[] = 'somename';
         $FieldNames[] = 'cat';
         if ( !isset($Col[$FieldNames[$Count]]['hide']) ) {
            $VisibleFields++;
            echo "$Count = $FieldNames[$Count]. ";
         }
      }

   }


   # This is the function which causes the problems.
   # Uses MySQL data and has a "$Col" argument.
   function Bad($Col='') {
      for ($Count = 0; $Count < $this->Cols; $Count++) {

         #############################
         #  "Field Name Call -- Short"
         #
          $FieldNames[] = $this->FieldName('test','here', $Count);

         #############################
         #  "Field Name Call -- Long"
         #
         # $FieldNames[] = $this->FieldName("FieldName() had error when RSATbl() was called by $FileName","$FileLine", $Count);

         #  PROBLEM HAPPENS ON NEXT LINE
         #  Commenting it and the closing } gets the
         #  problems to stop.
         if ( !isset($Col[$FieldNames[$Count]]['hide']) ) {
            
            # Commenting out the following line
            # completely shifts the pattern of what
            # is okay, crashes and infinite loops!
             $VisibleFields++;

            echo "$Count = $FieldNames[$Count]. ";
         }

      }# End of for $Count
   }# End of Bad()
}# End of class


$SQL = new Test;



# TEST SCENARIOS FOR RUNNING THE BAD() FUNCTION


# WHEN:    -----------------------------------
#   "Field Name Call -- Short"
#   "$VisibleFields++;" is open
#
# Okay if 1 or 2 Columns:
#   $SQL->Query = "SELECT concat('hi') as H";
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B";
# Infinite Loop if 3 Columns:
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B, concat('why') as W";
# Crashes if 4 Columns:
   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B, concat('why') as W, concat('oh') as O";


# WHEN:    -----------------------------------
#   "Field Name Call -- Long"
#   "$VisibleFields++;" is open
#
# Okay if 1 Column:
#   $SQL->Query = "SELECT concat('hi') as H";
# Infinite Loop if 2 Columns:
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B";
# Crash if 3 or more Columns:
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B, concat('why') as W";
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B, concat('why') as W, concat('oh') as O";


# WHEN:    -----------------------------------
#   "Field Name Call -- Long"
#   "$VisibleFields++;" is commented out
#
# Okay if 1 Column:
#   $SQL->Query = "SELECT concat('hi') as H";
# Infinite Loop if 2 or 3 Columns:
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B";
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B, concat('why') as W";
# Crashes if 4 Columns:
#   $SQL->Query = "SELECT concat('hi') as H, concat('bye') as B, concat('why') as W, concat('oh') as O";



# NOTE:  When "Infinite Loop" happens, PHP keeps
# going and going.  Trying to "End Process" in
# Task Manager won't kill it.  Only way to stop it
# is to reboot.
#
# This situation has hindered my ability to completely
# debug the problem due to the time involved with
# shutting down and rebooting.
#
# SUGGESTION:  Make PHP killable via Task Manager.


# Establish the MySQL connection and execute the query.
$SQL->Setup();



# Call the problematic function.
 $SQL->Bad();

# Call the plagued function, but set the argument.
# $Arg['H']['hide'] = 'N';
# $SQL->Bad($Arg);

# Call the safe functions.
# $SQL->Good();
# $SQL->NoProblem();




/*
DR WATSON REPORT WHEN:
   "Field Name Call -- Short"
   "$VisibleFields++;" is open
   Query String:  $SQL->Query = "SELECT concat('hi') as H,
      concat('bye') as B, concat('why') as W, concat('oh') as O";


Application exception occurred:
        App:  (pid=228)
        When: 2/27/2001 @ 15:15:2.88
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: BASE
        User Name: SYSTEM
        Number of Processors: 1
        Processor Type: x86 Family 6 Model 3 Stepping 4
        Windows Version: 4.0
        Current Build: 1381
        Service Pack: 6
        Current Type: Uniprocessor Free
        Registered Organization: Analysis and Solutions Company
        Registered Owner: Daniel Convissor

*----> Task List <----*
   0 Idle.exe
   2 System.exe
  24 SMSS.exe
  32 CSRSS.exe
  38 WINLOGON.exe
  46 SERVICES.exe
  49 LSASS.exe
  75 SPOOLSS.exe
  92 Apache.exe
  79 Apache.exe
  90 ubsched.exe
 100 mysqld.exe
 154 NPSSVC.exe
 160 RPCSS.exe
 166 TAPISRV.exe
 175 RASMAN.exe
 178 mstask.exe
 186 PSTORES.exe
  73 NDDEAGNT.exe
 211 EXPLORER.exe
 220 directcd.exe
 222 hpcron.exe
 213 LOADWC.exe
 218 PGPtray.exe
  70 NOTEPAD.exe
  86 netscape.exe
 228 php.exe
 239 DRWTSN32.exe
   0 _Total.exe

(00400000 - 00400000) 
(77f60000 - 77fbe000) dll\ntdll.dbg
(10000000 - 10000000) 
(77f00000 - 77f5e000) dll\kernel32.dbg
(77e70000 - 77ec5000) dll\user32.dbg
(77ed0000 - 77efc000) dll\gdi32.dbg
(77dc0000 - 77dff000) dll\advapi32.dbg
(77e10000 - 77e67000) dll\rpcrt4.dbg
(776d0000 - 776d8000) dll\wsock32.dbg
(776b0000 - 776c4000) dll\ws2_32.dbg
(78000000 - 78040000) 
(776a0000 - 776a7000) dll\ws2help.dbg
(77b20000 - 77bd7000) dll\ole32.dbg
(65340000 - 653d2000) oleaut32.dbg
(6a980000 - 6a9b4000) odbc32.dbg
(71700000 - 7178a000) COMCTL32.dbg
(77c40000 - 77d7c000) dll\shell32.dbg
(77d80000 - 77db2000) dll\comdlg32.dbg
(77a90000 - 77a9b000) dll\version.dbg
(779c0000 - 779c8000) dll\lz32.dbg
(780a0000 - 780b2000) 
(04a00000 - 04a13000) ..\RES\US\ODBCLAN\\ndebug32\ODBCINT.dll
(74ff0000 - 74ffe000) dll\rnr20.dbg
(77bf0000 - 77bf7000) dll\rpcltc1.dbg
(75360000 - 75367000) dll\rasadhlp.dbg
(77660000 - 7766f000) dll\msafd.dbg
(77690000 - 77699000) dll\wshtcpip.dbg

State Dump for Thread Id 0xee

eax=74736574 ebx=007b6d70 ecx=007f0d20 edx=007f0d20 esi=74736574 edi=007b99a4
eip=10089327 esp=0012fe8c ebp=00000004 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000206


function: <nosymbols>
        10089309 6a00             push    0x0
        1008930b 50               push    eax
        1008930c e85f470000       call    1008da70
        10089311 8bd8             mov     ebx,eax
        10089313 83c408           add     esp,0x8
        10089316 bd04000000       mov     ebp,0x4
        1008931b 8dbb342c0000     lea     edi,[ebx+0x2c34]       ds:007b99a4=007f0690
        10089321 8b07             mov     eax,[edi]              ds:007b99a4=007f0690
        10089323 85c0             test    eax,eax
        10089325 7411             jz      10089338
FAULT ->10089327 8b30             mov     esi,[eax]              ds:74736574=????????
        10089329 50               push    eax
        1008932a e891fbffff       call    10088ec0
        1008932f 83c404           add     esp,0x4
        10089332 8bc6             mov     eax,esi
        10089334 85f6             test    esi,esi
        10089336 75ef             jnz     10089327
        10089338 c70700000000     mov     dword ptr [edi],0x0    ds:007b99a4=007f0690
        1008933e 83c704           add     edi,0x4
        10089341 4d               dec     ebp
        10089342 75dd             jnz     10089321
        10089344 8b03             mov     eax,[ebx]              ds:007b6d70=007f3520

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00000004 00000000 00000000 00000000 00000000 00000000 <nosymbols> 

*----> Raw Stack Dump <----*
0012fe8c  24 20 02 78 e4 15 7c 00 - bc fe 12 00 01 00 00 00  $ .x..|.........
0012fe9c  f5 26 00 10 00 00 00 00 - 00 00 00 00 a0 02 7c 00  .&............|.
0012feac  10 1a 7c 00 a0 02 7c 00 - b0 35 7c 00 b0 14 7c 00  ..|...|..5|...|.
0012febc  4c ff 12 00 4f 1b 40 00 - 00 00 00 00 00 00 00 00  L...O.@.........
0012fecc  00 00 00 00 00 f0 fd 7f - 00 00 00 00 00 00 00 00  ................
0012fedc  04 00 00 00 00 00 00 00 - 00 00 00 00 8c cc 00 78  ...............x
0012feec  50 33 13 00 f0 b3 03 78 - 00 f0 fd 7f 10 05 7c 00  P3.....x......|.
0012fefc  34 ff 12 00 03 6f f6 77 - 10 ed 7c 00 00 00 00 00  4....o.w..|.....
0012ff0c  40 0d 7f 00 00 ff ff ff - 00 00 00 00 01 00 00 00  @...............
0012ff1c  00 00 00 00 01 00 00 00 - 10 05 7c 00 00 f0 fd 7f  ..........|.....
0012ff2c  00 00 00 00 a0 02 7c 00 - b0 14 7c 00 b0 35 7c 00  ......|...|..5|.
0012ff3c  01 00 00 00 00 00 00 00 - 00 00 00 00 10 1a 7c 00  ..............|.
0012ff4c  c0 ff 12 00 cb 20 40 00 - 01 00 00 00 10 05 7c 00  ..... @.......|.
0012ff5c  d0 0e 7c 00 00 40 40 00 - 04 40 40 00 a4 ff 12 00  ..|..@@..@@.....
0012ff6c  94 ff 12 00 a0 ff 12 00 - 00 00 00 00 98 ff 12 00  ................
0012ff7c  08 40 40 00 0c 40 40 00 - 00 00 00 00 00 00 00 00  .@@..@@.........
0012ff8c  00 f0 fd 7f 05 00 00 c0 - 10 05 7c 00 00 00 00 00  ..........|.....
0012ff9c  45 c2 11 80 d0 0e 7c 00 - 01 00 00 00 84 ff 12 00  E.....|.........
0012ffac  d4 fc 12 00 e0 ff 12 00 - 20 21 40 00 50 31 40 00  ........ !@.P1@.
0012ffbc  00 00 00 00 f0 ff 12 00 - ea b9 f1 77 00 00 00 00  ...........w....

State Dump for Thread Id 0xeb

eax=00007530 ebx=00000000 ecx=000000ee edx=00000000 esi=77e726e5 edi=00fdff6c
eip=77e72397 esp=00fdff24 ebp=00fdff48 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246


function: InvalidateRect
        77e7237e b89e110000       mov     eax,0x119e
        77e72383 8d542404         lea     edx,[esp+0x4]          ss:0200e92b=????????
        77e72387 cd2e             int     2e
        77e72389 c20c00           ret     0xc
        77e7238c b885110000       mov     eax,0x1185
        77e72391 8d542404         lea     edx,[esp+0x4]          ss:0200e92b=????????
        77e72395 cd2e             int     2e
        77e72397 c21400           ret     0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1  Param#2  Param#3  Param#4  Function Name
00fdff48 10093425 00fdff6c 00000000 00000000 00000000 user32!InvalidateRect 

*/
?>

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-02-27 15:39 UTC] derick@php.net
Can you possible reproduce it with a script that does not use databases? It's kinda hard to reproduce this way for us.
 [2001-02-27 15:49 UTC] danielc at analysisandsolutions dot com
I took the ease of your being able to run the tests via database into account.  The queries don't call any fields.  They just call the concat() function.  All you need to do with the database is put in host, user, pass, and name of a valid database.

I haven't been able to reproduce it w/o the databse connection.
 [2001-04-28 14:33 UTC] jmoore@php.net
I just spent last 20 mins playing with this and cant reproduce what soever, please try with 4.0.5 and latest CVS too and reopen bugreport if it still occurs I can get this to work at all. Please also provide a simpler example script we dont need to know everything that works just what doesnt.

- James
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 23:01:28 2024 UTC