php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #55662 mysql_stmt_result_metadata() returns invalid metadata on EXPLAIN then crash PHP
Submitted: 2011-09-10 04:39 UTC Modified: 2011-09-17 03:25 UTC
From: laruence@php.net Assigned: mysql (profile)
Status: Closed Package: MySQLi related
PHP Version: 5.4SVN-2011-09-10 (SVN) OS: Linux 64bit
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: laruence@php.net
New email:
PHP Version: OS:

 

 [2011-09-10 04:39 UTC] laruence@php.net 
Description:
------------
ext/mysqli/tests/mysqli_explain_metadata.phpt cause a segment fault(linked 
against libmysql)



backtrace:
#0  0x000000302af6ff20 in strlen () from /lib64/tls/libc.so.6
#1  0x00000000007dbeb5 in add_property_string_ex (arg=0x2a99479160, key=0xb68dec 
"catalog", key_len=8, 
    str=0x20200a3e6e6f6974 <Address 0x20200a3e6e6f6974 out of bounds>, 
duplicate=1)
    at /home/huixc/opensource/php-src/trunk/Zend/zend_API.c:1561
#2  0x00000000005f9a35 in php_add_field_properties (value=0x2a99479160, 
field=0x1000410)
    at /home/huixc/opensource/php-src/trunk/ext/mysqli/mysqli_api.c:1060
#3  0x00000000005f9d80 in zif_mysqli_fetch_fields (ht=1, 
return_value=0x2a994bcf68, return_value_ptr=0x0, this_ptr=0x0, 
return_value_used=1)
    at /home/huixc/opensource/php-src/trunk/ext/mysqli/mysqli_api.c:1118
#4  0x000000000080e1b6 in zend_do_fcall_common_helper_SPEC 
(execute_data=0x2a95fbc0e8)
    at /home/huixc/opensource/php-src/trunk/Zend/zend_vm_execute.h:642
#5  0x000000000081491a in ZEND_DO_FCALL_SPEC_CONST_HANDLER 
(execute_data=0x2a95fbc0e8)
    at /home/huixc/opensource/php-src/trunk/Zend/zend_vm_execute.h:2215
#6  0x000000000080ceba in execute (op_array=0xff40d0) at 
/home/huixc/opensource/php-src/trunk/Zend/zend_vm_execute.h:410
#7  0x00000000007d559c in zend_execute_scripts (type=8, retval=0x0, 
file_count=3) at /home/huixc/opensource/php-src/trunk/Zend/zend.c:1262
#8  0x000000000075698b in php_execute_script (primary_file=0x7fbffff230) at 
/home/huixc/opensource/php-src/trunk/main/main.c:2388
#9  0x00000000008f53f9 in do_cli (argc=2, argv=0x7fbffff518) at 
/home/huixc/opensource/php-src/trunk/sapi/cli/php_cli.c:983
#10 0x00000000008f629a in main (argc=2, argv=0x7fbffff518) at 
/home/huixc/opensource/php-src/trunk/sapi/cli/php_cli.c:1356


f2, 
(gdb) p *field
$2 = {name = 0x10007d0 "possible_keys", org_name = 0x10007e0 "", table = 
0x10007c0 "", org_table = 0x10007c8 "", db = 0x10007b8 "", 
  catalog = 0x20200a3e6e6f6974 <Address 0x20200a3e6e6f6974 out of bounds>, def = 
0x0, length = 4096, max_length = 0, 
  name_length = 537542259, org_name_length = 1818311712, table_length = 
1047748969, org_table_length = 762278761, db_length = 959789112, 
  catalog_length = 792474157, def_length = 1634298977, flags = 0, decimals = 31, 
charsetnr = 8, type = MYSQL_TYPE_VAR_STRING, 
  extension = 0x61696c612f3c3130}

Test script:
---------------
ext/mysqli/tests/mysqli_explain_metadata.phpt  

Expected result:
----------------
passed

Actual result:
--------------
seg fault

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-09-10 12:11 UTC] laruence@php.net
-Assigned To: +Assigned To: mysql
 [2011-09-12 11:33 UTC] andrey@php.net
-Status: Assigned +Status: Feedback
 [2011-09-12 11:33 UTC] andrey@php.net 
Hi,
can you provide me with info about the version of your MySQL Server and the client library.
Thanks!
 [2011-09-12 11:38 UTC] laruence@php.net
-Status: Feedback +Status: Open
 [2011-09-12 11:38 UTC] laruence@php.net 
Server version: 5.1.30 Source distribution, libmysql is also built from 5.1.30
 [2011-09-12 13:02 UTC] uw@php.net
-Status: Assigned +Status: Open
 [2011-09-12 13:02 UTC] uw@php.net 
MySQL not PHP issue, http://bugs.mysql.com/?id=62350 .
 [2011-09-12 13:04 UTC] uw@php.net
-Status: Assigned +Status: Bogus
 [2011-09-12 13:04 UTC] uw@php.net 
Server/libmysql issue.
 [2011-09-12 13:12 UTC] laruence@php.net
-Summary: test script cause seg fault +Summary: mysql_stmt_result_metadata() returns invalid metadata on EXPLAIN then crash PHP
 [2011-09-12 13:15 UTC] laruence@php.net 
change title for more significant
 [2011-09-17 03:25 UTC] laruence@php.net
-Status: Bogus +Status: Closed
 [2011-09-17 03:25 UTC] laruence@php.net 
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

see #55703
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Dec 05 13:00:02 2025 UTC