php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #59911 db2 driver stomping on memory used by other php extensions (creates seg fault)
Submitted: 2011-08-24 04:37 UTC Modified: 2011-09-02 04:49 UTC
From: xavier dot prudhomme at gmail dot com Assigned:
Status: Closed Package: ibm_db2 (PECL)
PHP Version: 5.3.8 OS: Ubuntu 10.04 LTS
Private report: No CVE-ID: None
 [2011-08-24 04:37 UTC] xavier dot prudhomme at gmail dot com
Description:
------------
For a complete description of this bug, please see this 
topic: http://groups.google.com/group/mongodb-
user/browse_thread/thread/be07a66d75368f76

Basically, I got a segmentation fault when running a piece 
of code using a foreach loop on a mongodb cursor, which I 
first believed to be a mongodb php driver issue. However, 
when running my php script with the gnu debugger, here is 
what I got:

Program received signal SIGSEGV, Segmentation fault. 
_php_ibm_db2_conn (le=0x12aa920) at /home/xavier/temp/php-
5.3.7/ext/ 
ibm_db2/ibm_db2.c:645 
645             if (conn_res->flag_transaction == 1) { 
(gdb) bt 
#0  _php_ibm_db2_conn (le=0x12aa920) at 
/home/xavier/temp/php-5.3.7/ 
ext/ibm_db2/ibm_db2.c:645 
#1  0x00000000007cc1b5 in zend_hash_apply (ht=0xfa78b8, 
apply_func=0x576090 <_php_ibm_db2_conn>) at 
/home/xavier/temp/ 
php-5.3.7/Zend/zend_hash.c:674 
#2  0x0000000000571e3e in zm_deactivate_ibm_db2 (type=<value 
optimized 
out>, module_number=<value optimized out>) at 
/home/xavier/temp/ 
php-5.3.7/ext/ibm_db2/ibm_db2.c:663 
#3  0x00000000007c16ac in module_registry_cleanup (module=
<value 
optimized out>) at /home/xavier/temp/php-
5.3.7/Zend/zend_API.c:2168 
#4  0x00000000007cc084 in zend_hash_reverse_apply 
(ht=0xfa7ec0, 
apply_func=0x7c1690 <module_registry_cleanup>) at 
/home/xavier/temp/ 
php-5.3.7/Zend/zend_hash.c:757 
#5  0x00000000007c00dd in zend_deactivate_modules () at 
/home/xavier/ 
temp/php-5.3.7/Zend/zend.c:867 
#6  0x000000000076c945 in php_request_shutdown (dummy=<value 
optimized 
out>) at /home/xavier/temp/php-5.3.7/main/main.c:1614 
#7  0x0000000000849478 in main (argc=<value optimized out>, 
argv=<value optimized out>) at /home/xavier/temp/php-
5.3.7/sapi/cli/ 
php_cli.c:1363 


So it seems that the ibm_db2 driver is stomping on memory 
used by others php extensions.

		
Kristina Chodorow helped me with this issue and wrote :

"PHP keeps a list of persistent bits of memory that is 
shared by all 
extensions.  The DB2 extension is going through the entire 
list and treating 
everything as a struct allocated by DB2.  However, the Mongo 
extension uses 
that list, too!  DB2 is trying to destroy all of Mongo's 
persistent structs 
at the end of each request.  You could file a bug with the 
DB2 extension, I 
don't know how active development is. 
You might also be able to fix it yourself by adding: 
if (le->type != le_pconn_struct) { 
  return ZEND_HASH_APPLY_KEEP; 
} 

right before the line that segfaulted ( if (conn_res-
>flag_transaction == 1) 
{ ), so you'd end up with: 
static int _php_ibm_db2_conn (zend_rsrc_list_entry *le 
TSRMLS_DC) 
{ 
    conn_handle *conn_res; 
    int rc = 0; 
    conn_res = (conn_handle *) le->ptr; 
    if (le->type != le_pconn_struct) { 
        return ZEND_HASH_APPLY_KEEP; 
    } 
    if (conn_res->flag_transaction == 1) { 
        conn_res->flag_transaction = 0; 
        if( conn_res->handle_active && conn_res-
>flag_pconnect ) { 
in ibm_db2.c.  This makes DB2 only destroy structs DB2 
'owns'. "


I did the modification in the ibm_db2.c file, and it did the 
trick, now it works fine.  I guess this should be added in a 
next release of the ibm_db2 driver.

About my configuration: I am using php 5.3.7 (but got 
exactly the same issue with 5.3.6), ibm_db2 php driver 
1.9.1, mongodb php driver 1.2.4, os : ubuntu 10.04 LTS.

Hope this could help.

Reproduce code:
---------------
Please see topic here : 
http://groups.google.com/group/mongodb-user/browse_thread/thread/be07a66d75368f76

Expected result:
----------------
Just a code that runs fine without any segmentation fault


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-08-24 06:36 UTC] abhargav at in dot ibm dot com
Try the latest release: http://pecl.php.net/get/ibm_db2-1.9.2.tgz

Regards,
Ambrish Bhargava
 [2011-08-24 10:15 UTC] xavier dot prudhomme at gmail dot com
I have tested the lastest release (1.9.2) and still got the 
same segmentation fault:

Program received signal SIGSEGV, Segmentation fault.
_php_ibm_db2_conn (le=0x8a983c0) at /home/wizome/temp/php-
5.3.8/ext/ibm_db2/ibm_db2.c:660
660		if ( conn_res->handle_active ) {
(gdb) bt
#0  _php_ibm_db2_conn (le=0x8a983c0) at 
/home/wizome/temp/php-5.3.8/ext/ibm_db2/ibm_db2.c:660
#1  0x083c150f in zend_hash_apply (ht=0x88d492c, 
apply_func=0x81b1ab0 <_php_ibm_db2_conn>) at 
/home/wizome/temp/php-5.3.8/Zend/zend_hash.c:674
#2  0x081ac10a in zm_deactivate_ibm_db2 (type=1, 
module_number=18) at /home/wizome/temp/php-
5.3.8/ext/ibm_db2/ibm_db2.c:676
#3  0x083b75b0 in module_registry_cleanup (module=0x88f2a68) 
at /home/wizome/temp/php-5.3.8/Zend/zend_API.c:2168
#4  0x083c13f8 in zend_hash_reverse_apply (ht=0x88d4cc0, 
apply_func=0x83b7590 <module_registry_cleanup>) at 
/home/wizome/temp/php-5.3.8/Zend/zend_hash.c:757
#5  0x083b6119 in zend_deactivate_modules () at 
/home/wizome/temp/php-5.3.8/Zend/zend.c:867
#6  0x08363d15 in php_request_shutdown (dummy=0x0) at 
/home/wizome/temp/php-5.3.8/main/main.c:1614
#7  0x08436253 in main (argc=2, argv=0xbffff754) at 
/home/wizome/temp/php-5.3.8/sapi/cli/php_cli.c:1363
(gdb) 


By adding these lignes :

if (le->type != le_pconn_struct) { 
  return ZEND_HASH_APPLY_KEEP; 
} 

right before the line that segfaulted , it fixes the issue.

Kind Regards
 [2011-08-24 16:45 UTC] nickcgates at gmail dot com
I am experiencing exactly the same problem. Running Ubuntu 
10.02, with:

ibm_db2 1.9.2
mongo   1.2.3
 [2011-08-31 05:24 UTC] lior dot k at zend dot com
Hi,

We encountered the same problem while testing both mongo and ibm_db2. The problem is that ibm_db2 doesn't check the resource type before trying to free/handle with it.

The following patch by Yoram Bar Haim <yoram.b@zend.com> seem to fix that:

--- ibm_db2.c	(revision 315696)
+++ ibm_db2.c	(working copy)
@@ -656,6 +656,10 @@
 	conn_handle *conn_res;
 	int rc = 0;
 
+	/* don't act onresource is we don't "own" it */
+	if (le->type != le_pconn_struct) {
+		return ZEND_HASH_APPLY_KEEP;
+	}
 	conn_res = (conn_handle *) le->ptr;
 	if ( conn_res->handle_active ) {
 		if ( conn_res->flag_transaction == 1 && conn_res->auto_commit == 0 ) {

Good luck,

Lior Kaplan
Zend Technologies Inc.
 [2011-09-02 04:49 UTC] abhargav at in dot ibm dot com
This bug has been fixed in SVN.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pecl.php.net.

In case this was a pecl.php.net website problem, the change will show
up on the website in short time.
 
Thank you for the report, and for helping us make PECL better.

Hi,

I have fixed this issue in SVN. Will include it in future release.

Regards,
Ambrish Bhargava
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Dec 26 15:01:32 2024 UTC