Description:
------------
I wrote code to retrieve data that was returned from a query with Oracle cursor. However oci_fetch_assoc() causes Apache 2.2.11 being crashed and restarted. I am not sure if it is a Oracle client native library or OCI8 issue.

Reproduce code:
---------------
<?php

$conn = oci_connect("hr", "hr", 'xe');

$sql  = "SELECT department_id, department_name, CURSOR(SELECT COUNT(employee_id) num_empl
                                                      FROM employees e
                                                      WHERE e.department_id = d.department_id) AS empl_count
         FROM departments d";
$stmt = oci_parse($conn, $sql);

oci_execute($stmt);

while ($data = oci_fetch_assoc($stmt))
{

}

oci_free_statement($stmt);
oci_close($conn);
?>


Expected result:
----------------
Those code is a slightly modified version taken from PHP Manual http://vn2.php.net/oci_new_cursor

It should be executed without any crash and data can be retrieved normally (as guided by PHP Manual)

Actual result:
--------------
Apache crashes and restarts

Type of Analysis Performed   Crash Analysis 
Machine Name   HOME-4F44218659 
Operating System   Windows XP Service Pack 3 
Number Of Processors   2 
Process ID   2200 
Process Image   C:\server\Apache2.2\bin\httpd.exe 
System Up-Time   10:12:12 
Process Up-Time   00:01:07 


Thread 169 - System ID 2128
Entry point   msvcrt!endthreadex+3a 
Create time   1/30/2009 1:57:53 AM 
Time spent in user mode   0 Days 0:0:0.15 
Time spent in kernel mode   0 Days 0:0:0.93 






Function     Arg 1     Arg 2     Arg 3   Source 
OraClient10!kpufhndl0+33     4e5f544e     00000002     00000000    
OraClient10!kpufhndl+10     4e5f544e     00000002     049ff9e8    
OraClient10!OCIHandleFree+1a     4e5f544e     00000002     0084eef0    
oci!OCIHandleFree+1d     4e5f544e     00000002     01b8a9d8    
php_oci8!php_oci_statement_free+121     05ecf448     01b8a9d8     0083aa23    
php_oci8!php_oci_statement_list_dtor+11     05ed09b8     01b8a9d8     01be5278    
php5ts!list_entry_destructor+43     05ed09b8     01b8a9d8     05ed0988    
php5ts!zend_hash_apply_deleter+97     01be5278     05ed0988     01b8a9d8    
php5ts!zend_hash_apply_with_argument+5a     01be5278     01976a90     00000022    
php_oci8!zm_deactivate_oci+8a     00000001     00000029     01b8a9d8    
php5ts!module_registry_cleanup+1c     00fd4ec8     01b8a9d8     01b8a9d8    
php5ts!zend_hash_apply+40     00cd7340     007882c0     01b8a9d8    
php5ts!zend_deactivate_modules+62     049fffa4     00000000     56433230    
php5ts!zend_deactivate_modules+48     01b82a01     00000000     05ecc7c0    
php5ts!php_end_ob_buffers+26     01b8a9d8     0073a040     01b8a9d8    
php5ts!php_request_shutdown+247     00000000     00622fb6     01b82a18    
php5apache2_2!php_apache_request_dtor+8     01b82a18     01b8a9d8     00000005    
php5apache2_2!php_handler+646     01b82a18     0073a040     01b82a18    
libhttpd!ap_run_handler+21     01b82a18     01b82a18     01b82a18    
libhttpd!ap_invoke_handler+ae     00000000     01b7d9c0     049fff38    
libhttpd!ap_die+29e     01b82a18     00000000     007447a8    
libhttpd!ap_get_request_note+1c9c     01b7d9c0     01b7d9c0     01b7d9c0    
libhttpd!ap_run_process_connection+21     01b7d9c0     007121e8     049fff80    
libhttpd!ap_process_connection+33     01b7d9c0     01b76990     00e40000    
libhttpd!ap_regkey_value_remove+c7c     01b7d9b8     00e40000     00e80000    
msvcrt!endthreadex+a9     01b73958     00e40000     00e80000    
kernel32!GetModuleFileNameA+1b4     77c3a341     01b73958     00000000    




ORACLIENT10!KPUFHNDL0+33WARNING - DebugDiag was not able to locate debug symbols for OraClient10.Dll, so the information below may be incomplete.



In httpd__PID__2200__Date__01_30_2009__Time_01_59_00AM__328__Second_Chance_Exception_C0000005.dmp the assembly instruction at OraClient10!kpufhndl0+33 in C:\oraclexe\app\oracle\product\10.2.0\server\BIN\OraClient10.Dll from Oracle Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x4e5f544e on thread 169

Module Information 
Image Name: C:\oraclexe\app\oracle\product\10.2.0\server\BIN\OraClient10.Dll   Symbol Type:  Export 
Base address: 0x61c20000   Time Stamp:  Wed Feb 01 04:19:50 2006  
Checksum: 0x00251a65   Comments:   
COM DLL: False   Company Name:  Oracle Corporation 
ISAPIExtension: False   File Description:  Oracle RDBMS Client Library 
ISAPIFilter: False   File Version:  10.2.0.1.0 Production 
Managed DLL: False   Internal Name:   
VB DLL: False   Legal Copyright:  Copyright Oracle 1979, 2004. All rights reserved. 
Loaded Image Name:  OraClient10.Dll   Legal Trademarks:   
Mapped Image Name:     Original filename:  oraclient10.dll 
Module name:  OraClient10   Private Build:   
Single Threaded:  False   Product Name:   
Module Size:  2.32 MBytes   Product Version:   
Symbol File Name:  OraClient10.Dll   Special Build:  &