php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #30430 odbc_next_result bugs
Submitted: 2004-10-14 13:11 UTC Modified: 2005-01-18 16:07 UTC
Votes:3
Avg. Score:4.0 ± 0.8
Reproduced:3 of 3 (100.0%)
Same Version:3 (100.0%)
Same OS:3 (100.0%)
From: pdan-php at esync dot org Assigned:
Status: Closed Package: ODBC related
PHP Version: 4.3.9 OS: Linux
Private report: No CVE-ID:
 [2004-10-14 13:11 UTC] pdan-php at esync dot org
Description:
------------
odbc_next_result does not set the corresponding internal php_odbc structures if SQLMoreResults returns SQL_SUCCESS

The following patch against 4.3.9 fixes the issue, at least from a 'user's perspective:

--- ext/odbc/php_odbc.c.orig    2004-10-13 21:44:05.000000000 +0300
+++ ext/odbc/php_odbc.c 2004-10-13 21:44:28.000000000 +0300
@@ -2422,10 +2422,12 @@

    result->fetched = 0;
    rc = SQLMoreResults(result->stmt);
+    /*
    if (rc == SQL_SUCCESS) {
        RETURN_TRUE;
    }
-   else if (rc == SQL_SUCCESS_WITH_INFO) {
+   else */
+    if (rc == SQL_SUCCESS_WITH_INFO || rc == SQL_SUCCESS) {
        rc = SQLFreeStmt(result->stmt, SQL_UNBIND);
        SQLNumParams(result->stmt, &(result->numparams));
        SQLNumResultCols(result->stmt, &(result->numcols));


Reproduce code:
---------------
$con = odbc_connect($dsn, $user, $password);
if (!is_resource($con)) die("failed to connect");

$query = 'SELECT 1 AS A; SELECT 2 AS B, 3 AS C, 4 AS D; SELECT 5 AS E, 6 AS F;';

$qres = odbc_exec($con, $query);

if ($qres===false) die ("failed to execute");

do{
    while(odbc_fetch_row($qres)){
        for($f = 1; $f<=odbc_num_fields($qres); $f++){
            $val = odbc_result($qres, $f);
            echo('Field name: ' . odbc_field_name($qres, $f) . ', value=' . $val . ' (size=' . strlen($val) . ')' . "\n");
        }
    }
} while(odbc_next_result($qres));


Expected result:
----------------
Field name: A, value=1 (size=1)
Field name: B, value=2 (size=1)
Field name: C, value=3 (size=1)
Field name: D, value=4 (size=1)
Field name: E, value=5 (size=1)
Field name: F, value=6 (size=1)

(reproduce code as run on 4.3.9 with my odbc fix)

Actual result:
--------------
black php-4.3.9 # gdb sapi/cli/php
GNU gdb 6.0
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) set args b.php
(gdb) run
Starting program: /var/tmp/portage/php-4.3.9/work/php-4.3.9/sapi/cli/php b.php
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.
Field name: A, value=1 (size=1)

Program received signal SIGSEGV, Segmentation fault.
0x08112a8d in zif_odbc_result ()
(gdb) backtrace
#0  0x08112a8d in zif_odbc_result ()
#1  0x081fb77c in execute ()
#2  0x081ef6a5 in zend_execute_scripts ()
#3  0x081c8c05 in php_execute_script ()
#4  0x0820a18b in main ()

Even if the crash is in odbc_result, the real reason is in odbc_next_result.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-01-18 16:07 UTC] tony2001@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 18 20:01:57 2014 UTC