php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #39502 PDO_MySQL segfaults
Submitted: 2006-11-13 17:00 UTC Modified: 2007-02-03 01:00 UTC
From: indeyets at gmail dot com Assigned: wez (profile)
Status: No Feedback Package: PDO related
PHP Version: 5.2.1 RC4 OS: FreeBSD
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: indeyets at gmail dot com
New email:
PHP Version: OS:

 

 [2006-11-13 17:00 UTC] indeyets at gmail dot com
Description:
------------
PDO_MySQL still segfaults in 5.2.0

related bugs:
http://bugs.php.net/bug.php?id=37445
http://bugs.php.net/bug.php?id=37438

backtrace of 5.2.0 is in "Actual Result" field

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
0x28fbba2a in mysql_more_results () from /usr/local/lib/mysql/libmysqlclient.so.15
(gdb) bt
#0 0x28fbba2a in mysql_more_results () from /usr/local/lib/mysql/libmysqlclient.so.15
#1 0x2916bcb8 in pdo_mysql_stmt_dtor (stmt=0x85211cc) at /usr/ports/lang/php5/work/php-5.2.0/ext/pdo_mysql/mysql_statement.c:79
#2 0x2915fb9a in free_statement () from /usr/local/lib/php/20060613-debug/pdo.so
#3 0x2915fc0f in pdo_dbstmt_free_storage () from /usr/local/lib/php/20060613-debug/pdo.so
#4 0x288fc438 in ?? () from /usr/local/libexec/apache22/libphp5.so
#5 0x288fc2f3 in ?? () from /usr/local/libexec/apache22/libphp5.so
#6 0x288dc9ac in ?? () from /usr/local/libexec/apache22/libphp5.so
#7 0x288d0873 in ?? () from /usr/local/libexec/apache22/libphp5.so
#8 0x288d0a2c in ?? () from /usr/local/libexec/apache22/libphp5.so
#9 0x288dcc7b in ?? () from /usr/local/libexec/apache22/libphp5.so
#10 0x288e87d1 in ?? () from /usr/local/libexec/apache22/libphp5.so
#11 0x288f8b87 in ?? () from /usr/local/libexec/apache22/libphp5.so
#12 0x288f8ebd in ?? () from /usr/local/libexec/apache22/libphp5.so
#13 0x288fc129 in ?? () from /usr/local/libexec/apache22/libphp5.so
#14 0x288d0735 in ?? () from /usr/local/libexec/apache22/libphp5.so
#15 0x288de202 in ?? () from /usr/local/libexec/apache22/libphp5.so
#16 0x28895434 in ?? () from /usr/local/libexec/apache22/libphp5.so
#17 0x28943a78 in ?? () from /usr/local/libexec/apache22/libphp5.so
#18 0x2894407e in ?? () from /usr/local/libexec/apache22/libphp5.so
#19 0x08071f42 in ap_run_handler ()
#20 0x0807230d in ap_invoke_handler ()
#21 0x0807c92d in ap_internal_redirect ()
#22 0x2872bd34 in handler_redirect () from /usr/local/libexec/apache22/mod_rewrite.so
#23 0x08071f42 in ap_run_handler ()
#24 0x0807230d in ap_invoke_handler ()
#25 0x0807cce9 in ap_process_request ()
#26 0x0807a8f1 in ap_process_http_connection ()
#27 0x080777e2 in ap_run_process_connection ()
#28 0x08080367 in child_main ()
#29 0x08080530 in make_child ()
#30 0x08080a73 in ap_mpm_run ()
#31 0x08061f40 in main ()

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-13 17:49 UTC] iliaa@php.net
What version of MySQL are you using and can you provide the 
reproduce code.
 [2006-11-13 17:53 UTC] indeyets at gmail dot com
MySQL 5.0.21

reproduce code is difficult, as it happens inside of a very big CMS

the problem is temporarily solved for us, by commenting out this block: http://cvs.php.net/viewcvs.cgi/php-src/ext/pdo_mysql/mysql_statement.c?r1=1.48.2.12&r2=1.48.2.13
 [2006-11-14 16:13 UTC] iliaa@php.net
Try this patch:
http://bb.prohost.org/patch/pdo_my.txt
 [2006-11-16 10:00 UTC] indeyets at gmail dot com
still segfaults.

backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x28fbba2a in mysql_more_results () from /usr/local/lib/mysql/libmysqlclient.so.15
(gdb) bt
#0 0x28fbba2a in mysql_more_results () from /usr/local/lib/mysql/libmysqlclient.so.15
#1 0x2916bcbc in pdo_mysql_stmt_dtor (stmt=0x852bda0) at /usr/ports/lang/php5/work/php-5.2.0/ext/pdo_mysql/mysql_statement.c:80
#2 0x2915fb9a in free_statement () from /usr/local/lib/php/20060613-debug/pdo.so
#3 0x2915fc0f in pdo_dbstmt_free_storage () from /usr/local/lib/php/20060613-debug/pdo.so
#4 0x288fc438 in ?? () from /usr/local/libexec/apache22/libphp5.so
#5 0x288fc2f3 in ?? () from /usr/local/libexec/apache22/libphp5.so
#6 0x288dc9ac in ?? () from /usr/local/libexec/apache22/libphp5.so
#7 0x288d0873 in ?? () from /usr/local/libexec/apache22/libphp5.so
#8 0x288d0a2c in ?? () from /usr/local/libexec/apache22/libphp5.so
#9 0x288dcc7b in ?? () from /usr/local/libexec/apache22/libphp5.so
#10 0x288e87d1 in ?? () from /usr/local/libexec/apache22/libphp5.so
#11 0x288f8b87 in ?? () from /usr/local/libexec/apache22/libphp5.so
#12 0x288f8ebd in ?? () from /usr/local/libexec/apache22/libphp5.so
#13 0x288fc129 in ?? () from /usr/local/libexec/apache22/libphp5.so
#14 0x288d0735 in ?? () from /usr/local/libexec/apache22/libphp5.so
#15 0x288de202 in ?? () from /usr/local/libexec/apache22/libphp5.so
#16 0x28895434 in ?? () from /usr/local/libexec/apache22/libphp5.so
#17 0x28943a78 in ?? () from /usr/local/libexec/apache22/libphp5.so
#18 0x2894407e in ?? () from /usr/local/libexec/apache22/libphp5.so
#19 0x08071f42 in ap_run_handler ()
#20 0x0807230d in ap_invoke_handler ()
#21 0x0807c92d in ap_internal_redirect ()
#22 0x2872bd34 in handler_redirect () from /usr/local/libexec/apache22/mod_rewrite.so
#23 0x08071f42 in ap_run_handler ()
#24 0x0807230d in ap_invoke_handler ()
#25 0x0807cce9 in ap_process_request ()
#26 0x0807a8f1 in ap_process_http_connection ()
#27 0x080777e2 in ap_run_process_connection ()
#28 0x08080367 in child_main ()
#29 0x08080530 in make_child ()
#30 0x08080a73 in ap_mpm_run ()
#31 0x08061f40 in main ()

(gdb) list
80 mysql_free_result(res);
81 }
82 }
83 }
84 #endif
85 efree(S);
86 return 1;
87 }
88
89 static int pdo_mysql_stmt_execute(pdo_stmt_t *stmt TSRMLS_DC)

(gdb) print res
No symbol "res" in current context.

(gdb) frame 1
#1 0x2916bcbc in pdo_mysql_stmt_dtor (stmt=0x852bda0) at /usr/ports/lang/php5/work/php-5.2.0/ext/pdo_mysql/mysql_statement.c:80
80 mysql_free_result(res);

(gdb) list
75 break;
76 }
77
78 res = mysql_store_result(S->H->server);
79 if (res) {
80 mysql_free_result(res);
81 }
82 }
83 }
84 #endif

(gdb) print res
No symbol "res" in current context.

(gdb) print S
$1 = (pdo_mysql_stmt *) 0x84ed090

(gdb) print S-H
No symbol "H" in current context.

(gdb) print S->H
$2 = (pdo_mysql_db_handle *) 0x84a3080

(gdb) print S->H->server
$3 = (MYSQL *) 0x5a5a5a5a
 [2006-12-30 17:08 UTC] iliaa@php.net
Can you see if using the latest CVS makes any difference?
 [2007-01-07 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2007-01-26 13:11 UTC] indeyets at gmail dot com
still reproducible with 5.2.1 RC4

Core was generated by `httpd'.
Program terminated with signal 11, Segmentation fault.
#0 0x28fbba2a in mysql_more_results () from /usr/local/lib/mysql/libmysqlclient.so.15
(gdb) bt
#0 0x28fbba2a in mysql_more_results () from /usr/local/lib/mysql/libmysqlclient.so.15
#1 0x2916bcc4 in pdo_mysql_stmt_dtor (stmt=0x8592518) at /root/php/php-5.2.1RC4/ext/pdo_mysql/mysql_statement.c:80
#2 0x2915fb9a in free_statement () from /usr/local/lib/php/20060613-debug/pdo.so
#3 0x2915fc0f in pdo_dbstmt_free_storage () from /usr/local/lib/php/20060613-debug/pdo.so
#4 0x288fc438 in zend_objects_store_del_ref_by_handle (handle=45) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_objects_API.c:203
#5 0x288fc2f3 in zend_objects_store_del_ref (zobject=0x858de28) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_objects_API.c:165
#6 0x288dc9ac in _zval_dtor_func (zvalue=0x858de28, __zend_filename=0x289c0a68 "/usr/ports/lang/php5/work/php-5.2.0/Zend/zend_variables.h",
__zend_lineno=35) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_variables.c:52
#7 0x288d0873 in _zval_dtor (zvalue=0x858de28, __zend_filename=0x289c09e8 "/usr/ports/lang/php5/work/php-5.2.0/Zend/zend_execute_API.c", __zend_lineno=414)
at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_variables.h:35
#8 0x288d0a2c in _zval_ptr_dtor (zval_ptr=0x85916a0, __zend_filename=0x289c1b58 "/usr/ports/lang/php5/work/php-5.2.0/Zend/zend_variables.c",
__zend_lineno=175) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_execute_API.c:414
#9 0x288dcc7b in _zval_ptr_dtor_wrapper (zval_ptr=0x85916a0) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_variables.c:175
#10 0x288e87d1 in zend_hash_destroy (ht=0x858a92c) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_hash.c:712
#11 0x288f8b87 in zend_object_std_dtor (object=0x8588730) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_objects.c:45
#12 0x288f8ebd in zend_objects_free_object_storage (object=0x8588730) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_objects.c:122
#13 0x288fc129 in zend_objects_store_free_object_storage (objects=0x289e5d18) at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_objects_API.c:86
#14 0x288d0735 in shutdown_executor () at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend_execute_API.c:299
#15 0x288de202 in zend_deactivate () at /usr/ports/lang/php5/work/php-5.2.0/Zend/zend.c:921
#16 0x28895434 in php_request_shutdown (dummy=0x0) at /usr/ports/lang/php5/work/php-5.2.0/main/main.c:1306
#17 0x28943a78 in php_apache_request_dtor (r=0x8339948) at /usr/ports/lang/php5/work/php-5.2.0/sapi/apache2handler/sapi_apache2.c:455
#18 0x2894407e in php_handler (r=0x8339948) at /usr/ports/lang/php5/work/php-5.2.0/sapi/apache2handler/sapi_apache2.c:613
#19 0x08071f42 in ap_run_handler ()
#20 0x0807230d in ap_invoke_handler ()
#21 0x0807c92d in ap_internal_redirect ()
#22 0x2872bd34 in handler_redirect () from /usr/local/libexec/apache22/mod_rewrite.so
#23 0x08071f42 in ap_run_handler ()
#24 0x0807230d in ap_invoke_handler ()
#25 0x0807cce9 in ap_process_request ()
#26 0x0807a8f1 in ap_process_http_connection ()
#27 0x080777e2 in ap_run_process_connection ()
#28 0x08080367 in child_main ()
#29 0x0808059e in make_child ()
#30 0x0808111e in ap_mpm_run ()
#31 0x08061f40 in main ()
 [2007-01-26 13:54 UTC] tony2001@php.net
>still reproducible with 5.2.1 RC4

This does not look like 5.2.1RC4: 
/usr/ports/lang/php5/work/php-5.2.0/Zend/zend_execute_API.c
 [2007-02-03 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2008-05-28 20:46 UTC] adam at morrison-ind dot com
Seeing something very much like this in Bug#14006 using PDO_INFORMIX.  Backtrace goes back to free_statement.  For Bug#14006 a work around is to set the database connection and result = null when done and the seg. fault does not occur.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Jul 06 11:02:27 2025 UTC