php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61895 PHP core crash when call $pdoStmt->execute($array_params) with PDO_Firebird
Submitted: 2012-05-02 05:32 UTC Modified: 2016-11-07 16:35 UTC
Votes:6
Avg. Score:4.7 ± 0.7
Reproduced:5 of 5 (100.0%)
Same Version:3 (60.0%)
Same OS:2 (40.0%)
From: andrey at tranvi dot info Assigned: mariuz (profile)
Status: Closed Package: PDO Firebird
PHP Version: 5.3.11 OS: Windows
Private report: No CVE-ID: None
 [2012-05-02 05:32 UTC] andrey at tranvi dot info
Description:
------------
Here: http://pastebin.com/SPgP5xQX php code, minified for crashing.
Here: http://pastebin.com/MYZj9cPB sql code for creating database for test.

First, I try create prepared query:

$q=$db->prepare($sql);

when, in loop, I call $q->execute() with some params.

So, when I call execute() without any params - all ok. With 1 or 2 simple parameters - all ok too. When parameters is array of 11 elements, PHP core crash.

Under debug version, it's write this log:

[Wed May 02 10:11:46 2012] [error] [client 127.0.0.1] PHP Warning:  String is not zero-terminated
(String is not zero-terminated
(ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
ZZZZZZZZE\xc2'\x1eZZ)\xf0\x15d\x10\xc4\x01) (source:
c:\\php-sdk\\php53dev\\vc9\\x86\\zend\\zend_execute_api.c:447) in
D:\\test\\yii\\testing\\test_niokr.php on line 107, referer: http://localhost/testing/


I tested it under php5.3.10, php5.3.11 (binary download from official site)
and sself build 5.3.11 with VC9,thread safe, debug version

Release version simple crash. Debug version write many warnings, and crash too.


Test script:
---------------
Here: http://pastebin.com/SPgP5xQX php code, minified for crashing.
Here: http://pastebin.com/MYZj9cPB sql code


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-05-02 06:13 UTC] andrey at tranvi dot info
Backtrace:

 	php5ts_debug.dll!zend_error(int type=2, const char * format=0x10592b4c, ...)  Строка 979	C
>	php5ts_debug.dll!_zval_dtor_func(_zval_struct * zvalue=0x026e4408, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447)  Строка 35 + 0x2d байт	C
 	php5ts_debug.dll!_zval_dtor(_zval_struct * zvalue=0x026e4408, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447)  Строка 35 + 0x11 байт	C
 	php5ts_debug.dll!_zval_ptr_dtor(_zval_struct * * zval_ptr=0x026e6660, char * __zend_filename=0x1064d5dc, unsigned int __zend_lineno=293)  Строка 447 + 0x17 байт	C
 	php5ts_debug.dll!param_dtor(void * data=0x026e6650)  Строка 293 + 0x1a байт	C
 	php5ts_debug.dll!zend_hash_destroy(_hashtable * ht=0x026e4bc8)  Строка 529 + 0x11 байт	C
 	php5ts_debug.dll!zim_PDOStatement_execute(int ht=1, _zval_struct * return_value=0x026e2f60, _zval_struct * * return_value_ptr=0x00000000, _zval_struct * this_ptr=0x026e2b20, int return_value_used=0, void * * * tsrm_ls=0x02993f98)  Строка 453 + 0xc байт	C
 	php5ts_debug.dll!zend_do_fcall_common_helper_SPEC(_zend_execute_data * execute_data=0x026806e8, void * * * tsrm_ls=0x02993f98)  Строка 320 + 0x78 байт	C
 	php5ts_debug.dll!ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER(_zend_execute_data * execute_data=0x026806e8, void * * * tsrm_ls=0x02993f98)  Строка 426	C
 	php5ts_debug.dll!execute(_zend_op_array * op_array=0x02e038f0, void * * * tsrm_ls=0x02993f98)  Строка 107 + 0x11 байт	C
 	php5ts_debug.dll!zend_execute_scripts(int type=8, void * * * tsrm_ls=0x02993f98, _zval_struct * * retval=0x00000000, int file_count=3, ...)  Строка 1236 + 0x21 байт	C
 	php5ts_debug.dll!php_execute_script(_zend_file_handle * primary_file=0x00c1fed8, void * * * tsrm_ls=0x02993f98)  Строка 2308 + 0x1b байт	C
 	php.exe!main(int argc=4, char * * argv=0x02993e30)  Строка 1184 + 0x13 байт	C
 	php.exe!__tmainCRTStartup()  Строка 586 + 0x19 байт	C
 	php.exe!mainCRTStartup()  Строка 403	C
 	kernel32.dll!763fed6c() 	
 	[Указанные ниже фреймы могут быть неверны и (или) отсутствовать, символы для kernel32.dll не загружены]	
 	ntdll.dll!778237f5() 	
 	ntdll.dll!778237c8()
 [2012-05-02 06:26 UTC] andrey at tranvi dot info
If I create new PDOStatement, and free in loop, like this:
    foreach ($data as $item)
    {        
        $q=$db->prepare($sql);
$q->execute(array(":NIOKR_TYPE"=>$type,":INV_NO"=>$item[0],":NAME"=>$item[1],
                              ":CREATOR"=>$item[2],":N_DOG"=>$item[3],":AUTHOR"=>$item[4],
                              ":AYEAR"=>$item[5],":CITY"=>$item[6],":ANNOTATION"=>$item[7],
                              ":ACOUNT"=>$item[8],":GRIF"=>$item[9],":ACOMMENT"=>$item[10]));
           $q=null;
    }


 PHP crash in another place. 

With this backtrace:
>	php5ts_debug.dll!zend_mm_check_ptr(_zend_mm_heap * heap=0x01941c38, void * ptr=0x025e6b68, int silent=0, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447, char * __zend_orig_filename=0x10592b18, unsigned int __zend_orig_lineno=36)  Строка 1357 + 0x12 байт	C
 	php5ts_debug.dll!zend_mm_check_ptr(_zend_mm_heap * heap=0x01941c38, void * ptr=0x025e6b68, int silent=1, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447, char * __zend_orig_filename=0x10592b18, unsigned int __zend_orig_lineno=36)  Строка 1352 + 0x1f байт	C
 	php5ts_debug.dll!_zend_mm_free_int(_zend_mm_heap * heap=0x01941c38, void * p=0x025e6b68, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447, char * __zend_orig_filename=0x10592b18, unsigned int __zend_orig_lineno=36)  Строка 1993 + 0x1f байт	C
 	php5ts_debug.dll!_efree(void * ptr=0x025e6b68, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447, char * __zend_orig_filename=0x10592b18, unsigned int __zend_orig_lineno=36)  Строка 2361 + 0x2b байт	C
 	php5ts_debug.dll!_zval_dtor_func(_zval_struct * zvalue=0x025e5848, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447)  Строка 36 + 0x29 байт	C
 	php5ts_debug.dll!_zval_dtor(_zval_struct * zvalue=0x025e5848, char * __zend_filename=0x10587080, unsigned int __zend_lineno=447)  Строка 35 + 0x11 байт	C
 	php5ts_debug.dll!_zval_ptr_dtor(_zval_struct * * zval_ptr=0x025e53e8, char * __zend_filename=0x1064d5dc, unsigned int __zend_lineno=293)  Строка 447 + 0x17 байт	C
 	php5ts_debug.dll!param_dtor(void * data=0x025e53d8)  Строка 293 + 0x1a байт	C
 	php5ts_debug.dll!zend_hash_destroy(_hashtable * ht=0x025e58d8)  Строка 529 + 0x11 байт	C
 	php5ts_debug.dll!free_statement(_pdo_stmt_t * stmt=0x025e2e38, void * * * tsrm_ls=0x02833f98)  Строка 2390 + 0xc байт	C
 	php5ts_debug.dll!php_pdo_stmt_delref(_pdo_stmt_t * stmt=0x025e2e38, void * * * tsrm_ls=0x02833f98)  Строка 2448 + 0xd байт	C
 	php5ts_debug.dll!pdo_dbstmt_free_storage(_pdo_stmt_t * stmt=0x025e2e38, void * * * tsrm_ls=0x02833f98)  Строка 2454 + 0xd байт	C
 	php5ts_debug.dll!zend_objects_store_del_ref_by_handle_ex(unsigned int handle=2, const _zend_object_handlers * handlers=0x10797860, void * * * tsrm_ls=0x02833f98)  Строка 220 + 0x14 байт	C
 	php5ts_debug.dll!zend_objects_store_del_ref(_zval_struct * zobject=0x00c1f49c, void * * * tsrm_ls=0x02833f98)  Строка 172 + 0x14 байт	C
 	php5ts_debug.dll!_zval_dtor_func(_zval_struct * zvalue=0x00c1f49c, char * __zend_filename=0x10586530, unsigned int __zend_lineno=703)  Строка 52 + 0x15 байт	C
 	php5ts_debug.dll!_zval_dtor(_zval_struct * zvalue=0x00c1f49c, char * __zend_filename=0x10586530, unsigned int __zend_lineno=703)  Строка 35 + 0x11 байт	C
 	php5ts_debug.dll!zend_assign_to_variable(_zval_struct * * variable_ptr_ptr=0x025e4754, _zval_struct * value=0x02560570, int is_tmp_var=0, void * * * tsrm_ls=0x02833f98)  Строка 703 + 0x17 байт	C
 	php5ts_debug.dll!ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(_zend_execute_data * execute_data=0x025806e8, void * * * tsrm_ls=0x02833f98)  Строка 24163 + 0x13 байт	C
 	php5ts_debug.dll!execute(_zend_op_array * op_array=0x02e938f0, void * * * tsrm_ls=0x02833f98)  Строка 107 + 0x11 байт	C
 	php5ts_debug.dll!zend_execute_scripts(int type=8, void * * * tsrm_ls=0x02833f98, _zval_struct * * retval=0x00000000, int file_count=3, ...)  Строка 1236 + 0x21 байт	C
 	php5ts_debug.dll!php_execute_script(_zend_file_handle * primary_file=0x00c1fed8, void * * * tsrm_ls=0x02833f98)  Строка 2308 + 0x1b байт	C
 	php.exe!main(int argc=4, char * * argv=0x02833e30)  Строка 1184 + 0x13 байт	C
 	php.exe!__tmainCRTStartup()  Строка 586 + 0x19 байт	C
 	php.exe!mainCRTStartup()  Строка 403	C
 	kernel32.dll!763fed6c() 	
 	[Указанные ниже фреймы могут быть неверны и (или) отсутствовать, символы для kernel32.dll не загружены]	
 	ntdll.dll!778237f5() 	
 	ntdll.dll!778237c8()
 [2014-01-01 12:38 UTC] felipe@php.net
-Package: PDO related +Package: PDO Firebird
 [2014-04-08 11:18 UTC] mariuz@php.net
-Assigned To: +Assigned To: mariuz
 [2016-11-07 16:35 UTC] ab@php.net
-Status: Assigned +Status: Closed
 [2016-11-07 16:35 UTC] ab@php.net
Fixed in 7.0 via bug #73087.

Thanks.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 11:01:29 2024 UTC