php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #55662 mysql_stmt_result_metadata() returns invalid metadata on EXPLAIN then crash PHP
Submitted: 2011-09-10 04:39 UTC Modified: 2011-09-17 03:25 UTC
From: laruence@php.net Assigned: mysql (profile)
Status: Closed Package: MySQLi related
PHP Version: 5.4SVN-2011-09-10 (SVN) OS: Linux 64bit
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: laruence@php.net
New email:
PHP Version: OS:

 

 [2011-09-10 04:39 UTC] laruence@php.net 
Description:
------------
ext/mysqli/tests/mysqli_explain_metadata.phpt cause a segment fault(linked 
against libmysql)



backtrace:
#0  0x000000302af6ff20 in strlen () from /lib64/tls/libc.so.6
#1  0x00000000007dbeb5 in add_property_string_ex (arg=0x2a99479160, key=0xb68dec 
"catalog", key_len=8, 
    str=0x20200a3e6e6f6974 <Address 0x20200a3e6e6f6974 out of bounds>, 
duplicate=1)
    at /home/huixc/opensource/php-src/trunk/Zend/zend_API.c:1561
#2  0x00000000005f9a35 in php_add_field_properties (value=0x2a99479160, 
field=0x1000410)
    at /home/huixc/opensource/php-src/trunk/ext/mysqli/mysqli_api.c:1060
#3  0x00000000005f9d80 in zif_mysqli_fetch_fields (ht=1, 
return_value=0x2a994bcf68, return_value_ptr=0x0, this_ptr=0x0, 
return_value_used=1)
    at /home/huixc/opensource/php-src/trunk/ext/mysqli/mysqli_api.c:1118
#4  0x000000000080e1b6 in zend_do_fcall_common_helper_SPEC 
(execute_data=0x2a95fbc0e8)
    at /home/huixc/opensource/php-src/trunk/Zend/zend_vm_execute.h:642
#5  0x000000000081491a in ZEND_DO_FCALL_SPEC_CONST_HANDLER 
(execute_data=0x2a95fbc0e8)
    at /home/huixc/opensource/php-src/trunk/Zend/zend_vm_execute.h:2215
#6  0x000000000080ceba in execute (op_array=0xff40d0) at 
/home/huixc/opensource/php-src/trunk/Zend/zend_vm_execute.h:410
#7  0x00000000007d559c in zend_execute_scripts (type=8, retval=0x0, 
file_count=3) at /home/huixc/opensource/php-src/trunk/Zend/zend.c:1262
#8  0x000000000075698b in php_execute_script (primary_file=0x7fbffff230) at 
/home/huixc/opensource/php-src/trunk/main/main.c:2388
#9  0x00000000008f53f9 in do_cli (argc=2, argv=0x7fbffff518) at 
/home/huixc/opensource/php-src/trunk/sapi/cli/php_cli.c:983
#10 0x00000000008f629a in main (argc=2, argv=0x7fbffff518) at 
/home/huixc/opensource/php-src/trunk/sapi/cli/php_cli.c:1356


f2, 
(gdb) p *field
$2 = {name = 0x10007d0 "possible_keys", org_name = 0x10007e0 "", table = 
0x10007c0 "", org_table = 0x10007c8 "", db = 0x10007b8 "", 
  catalog = 0x20200a3e6e6f6974 <Address 0x20200a3e6e6f6974 out of bounds>, def = 
0x0, length = 4096, max_length = 0, 
  name_length = 537542259, org_name_length = 1818311712, table_length = 
1047748969, org_table_length = 762278761, db_length = 959789112, 
  catalog_length = 792474157, def_length = 1634298977, flags = 0, decimals = 31, 
charsetnr = 8, type = MYSQL_TYPE_VAR_STRING, 
  extension = 0x61696c612f3c3130}

Test script:
---------------
ext/mysqli/tests/mysqli_explain_metadata.phpt  

Expected result:
----------------
passed

Actual result:
--------------
seg fault

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-09-10 12:11 UTC] laruence@php.net
-Assigned To: +Assigned To: mysql
 [2011-09-12 11:33 UTC] andrey@php.net
-Status: Assigned +Status: Feedback
 [2011-09-12 11:33 UTC] andrey@php.net 
Hi,
can you provide me with info about the version of your MySQL Server and the client library.
Thanks!
 [2011-09-12 11:38 UTC] laruence@php.net
-Status: Feedback +Status: Open
 [2011-09-12 11:38 UTC] laruence@php.net 
Server version: 5.1.30 Source distribution, libmysql is also built from 5.1.30
 [2011-09-12 13:02 UTC] uw@php.net
-Status: Assigned +Status: Open
 [2011-09-12 13:02 UTC] uw@php.net 
MySQL not PHP issue, http://bugs.mysql.com/?id=62350 .
 [2011-09-12 13:04 UTC] uw@php.net
-Status: Assigned +Status: Bogus
 [2011-09-12 13:04 UTC] uw@php.net 
Server/libmysql issue.
 [2011-09-12 13:12 UTC] laruence@php.net
-Summary: test script cause seg fault +Summary: mysql_stmt_result_metadata() returns invalid metadata on EXPLAIN then crash PHP
 [2011-09-12 13:15 UTC] laruence@php.net 
change title for more significant
 [2011-09-17 03:25 UTC] laruence@php.net
-Status: Bogus +Status: Closed
 [2011-09-17 03:25 UTC] laruence@php.net 
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

see #55703
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Jul 12 16:01:33 2025 UTC