|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69060 PHP-CGI.EXE crashes in CLI when call mysqli_close() after a long period
Submitted: 2015-02-16 11:48 UTC Modified: 2015-03-20 16:57 UTC
From: julientld at free dot fr Assigned: ab (profile)
Status: Closed Package: CGI/CLI related
PHP Version: 5.6.5 OS: Windows Server 2012
Private report: No CVE-ID: None
 [2015-02-16 11:48 UTC] julientld at free dot fr

Windows Server 2012
IIS 8.0
PHP 5.6.5
MySQL 5.6.21
WinCache 1.3.x
hMailserver 5.6

I send a newsletter every week to thousands of users with the mail() function. The PHP script runs in CLI mode. It runs about 8 hours long. Timeouts and other settings have been customized for this.

All runs well, every body receives the mail. But I observe one error every week in the Windows Event Viewer saying php-cgi.exe has crashed at the end of the newsletter sending.

The PHP log file shows a PHP Warning related to the mail() function which returns a 550 Unknown user error.

In the SMTP server logs, in effect, I see that one of the last user which receives a mail at this hour (07:51:43) doesn't exists more. But, there are many other 550 errors during the sending and I don't see why this specific 550 error could be the cause.

In fact, I think that mail is absolutely not related to this bug. At the end of the script I call the mysqli_close() function to close the MySQL connexion opened 8 hours earlier but the MySQL server has probably killed it for a very long time !!!!!! :)

It is a bad conception of this code. I will modify it today to close the connexion before the mail sending where MySQL is no more used. But I just would like to notify you about this abnormal PHP error.

I have a dump file for the php-cgi.exe crash. I have shown it to an MS expert which says me :

"It appears to be a bug in the zend core, when printing debug messages on shutdown.  I haven't got the exact mechanics of the bug, but what appears to have happened is that php_mysqli ran into an error while trying to shutdown.

The process was in the middle of mysqli_close(), when it hit an error during a send on a socket.  Looks like the php_mysqlnd (internal PHP extension) tries to send a command when shutting down.  The extension failed to send, because the socket to the SQL server went away.  All of this is fine and normal.  However, the printing of the error message failed, due to some problem with memory allocation.  Seems weird, and not something that should happen every time.

It's an unfortunate side effect of a network failure during mysqli_close()."

Test script:
1) MySQL selection of the recipients

2) In a loop (about 8 hours long):

mail("","Subjet","Text","From:\r\nContent-Type: text/html; charset=iso-8859-1");

3) mysqli_close()   <<<<------ I will now move it between phases 1) and 2)

Expected result:
No errors in log files.

Actual result:

Nom de l’application défaillante php-cgi.exe, version :, horodatage : 0x54c04440
Nom du module défaillant : php5.dll, version :, horodatage : 0x54c04898
Code d’exception : 0xc0000005
Décalage d’erreur : 0x0004a838
ID du processus défaillant : 0xae8
Heure de début de l’application défaillante : 0x01d04973d362fdb0
Chemin d’accès de l’application défaillante : C:\php\php-cgi.exe
Chemin d’accès du module défaillant: C:\php\php5.dll
ID de rapport : 441a03a1-b5a8-11e4-9410-90b11c2fa6ed
Nom complet du package défaillant : 
ID de l’application relative au package défaillant : 


[16-Feb-2015 07:51:43 Europe/Paris] PHP Warning:  mail(): SMTP server response: 550 Unknown user in envoyer.php on line 2


"SMTPD"	2660	94856	"2015-02-16 07:51:43.823"	""	"SENT: 550 Unknown user"


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2015-02-17 17:48 UTC]
-Status: Open +Status: Feedback
 [2015-02-17 17:48 UTC]
@julientld, thanks for the report.

I'm not quite convinced yet mysqli is causing that crash. At least from the event log event you supply - the crash happens in mail().

Actually, as you've also consulted someone who saw the dump, you should be able to reproduce what you think it is. To do that - open some mysql connection from php and sleep for some short time, kill the mysql server, wait till php continues to run. This should be doing the same job disregarding how much time it lasts.

But as you have the dump, i'd also ask you to check whether you could at least provide the backtrace from there.

 [2015-02-19 18:10 UTC]
Here's the registers, call stack (with source lines), and local variables for the first two stack frames from the crash dump I investigated:
0:000> .ecxr
eax=03c8e1bb ebx=2009b224 ecx=00000000 edx=00000000 esi=01e3d8c0 edi=2009b224
eip=7401a838 esp=01a6e638 ebp=00000008 iopl=0         nv up ei ng nz ac po cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010293
7401a838 39590c          cmp     dword ptr [ecx+0Ch],ebx ds:002b:0000000c=????????
0:000> k
  *** Stack trace for last set context - .thread/.cxr resets it
 # ChildEBP RetAddr  
00 01a6e648 7400d0eb php5!_efree+0x248 [c:\php-sdk\php56\vc11\x86\php-5.6.5\zend\zend_alloc.c @ 2440]
01 01a6e690 7400c74b php5!php_verror+0x1bb [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\main.c @ 944]
02 01a6e6a8 74365476 php5!php_error_docref0+0x1b [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\main.c @ 958]
03 01a6e6ec 7402b11b php5!php_sockop_write+0x338da6 [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\streams\xp_socket.c @ 100]
04 01a6e70c 7402b0d9 php5!_php_stream_write_buffer+0x2b [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\streams\streams.c @ 1133]
05 01a6e71c 740b769d php5!_php_stream_write+0x29 [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\streams\streams.c @ 1242]
06 01a6e72c 740b7dc1 php5!php_mysqlnd_net_network_write_ex_pub+0x1d [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd_net.c @ 103]
07 01a6e784 740c7b7e php5!php_mysqlnd_net_send_ex_pub+0x151 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd_net.c @ 428]
08 01a6e7b8 740ac035 php5!php_mysqlnd_cmd_write+0x22e [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd_wireprotocol.c @ 999]
09 01a6e7f0 740ac0f8 php5!php_mysqlnd_conn_data_simple_command_send_request_pub+0x405 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd.c @ 356]
0a 01a6e810 740af2e2 php5!php_mysqlnd_conn_data_simple_command_pub+0x28 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd.c @ 381]
0b 01a6e840 740b1704 php5!php_mysqlnd_conn_data_send_close_pub+0x142 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd.c @ 1910]
0c 01a6e854 73ad3266 php5!php_mysqlnd_conn_close_pub+0xf4 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqlnd\mysqlnd.c @ 3155]
0d 01a6e86c 73ad3183 php_mysqli!php_mysqli_close+0x26 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqli\mysqli_api.c @ 698]
0e 01a6e88c 73ffff12 php_mysqli!zif_mysqli_close+0x73 [c:\php-sdk\php56\vc11\x86\php-5.6.5\ext\mysqli\mysqli_api.c @ 746]
0f 01a6e8e0 73fff6d3 php5!zend_do_fcall_common_helper_SPEC+0x122 [c:\php-sdk\php56\vc11\x86\php-5.6.5\zend\zend_vm_execute.h @ 558]
10 01a6e918 74037f8e php5!execute_ex+0x2a3 [c:\php-sdk\php56\vc11\x86\php-5.6.5\zend\zend_vm_execute.h @ 363]
11 01a6e93c 74012fce php5!zend_execute+0x14e [c:\php-sdk\php56\vc11\x86\php-5.6.5\zend\zend_vm_execute.h @ 388]
12 01a6e970 74012e4c php5!zend_execute_scripts+0xde [c:\php-sdk\php56\vc11\x86\php-5.6.5\zend\zend.c @ 1341]
13 01a6eba8 771435e1 php5!php_execute_script+0x14c [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\main.c @ 2584]
0:000> dv
            ptr = <Memory access error>
0:000> .frame 1
01 01a6e690 7400c74b php5!php_verror+0x1bb [c:\php-sdk\php56\vc11\x86\php-5.6.5\main\main.c @ 944]
0:000> dv
         docref = 0x020471c0 "mysqli_close(): "
         params = 0x74482afc ""
           type = 0n8
         format = 0x7456bde8 "send of %ld bytes failed with errno=%ld %s"
           args = 0x01a6e6bc "???"
         buffer = 0x0e25e590 ""
     docref_buf = 0x0e25e590 ""
         origin = 0x0e25e590 ""
        message = 0x020471c0 "mysqli_close(): "
          space = 0x74482afc ""
            len = 0
            len = 0xe
            tmp = 0x74482afc
 [2015-02-19 19:48 UTC]
@julientld, @ericsten ok, with the backtrace ist's much more clear. I hardly guess this issue is fixed in the patche within bug #69060.

@julientld please check with any suitable latest snap . Seems this fix didn't land in 5.6.6 yet, but expect it in the 5.6 next.

 [2015-02-19 19:54 UTC]
my bad, replace "hardly" with "greatly" in my previous comment.

 [2015-02-19 20:36 UTC]
bug #68996 is what i'm referencing.

 [2015-02-20 03:04 UTC] julientld at free dot fr

I update php to the last snaps as suggested.
I will say you monday if the bug is still present.

Thank you Eric and AB!
 [2015-02-20 08:19 UTC] julientld at free dot fr

Latest PHP 5.6 snaps seems to be only available in x64 packages:

Could you add x86 VC11 NTS ?
 [2015-02-20 09:05 UTC]
Seems that's a build bot issue with the missing x86 builds last week. But you can take this one from Feb. 10th as these fixes should be in there (or any snap after the 8th). But please do not upgrade to a snap build, it only should be used for tests.

 [2015-02-20 09:19 UTC] julientld at free dot fr
Thank you, I will test this 10th Feb. build.
 [2015-02-23 08:46 UTC] julientld at free dot fr

I confirm you that the bug doesn't occur with the PHP 5.6.7 snaps (r4d8db15).

No error in PHP log, SMTP log and Windows Event Viewer.

Thank you for the fix.
 [2015-02-23 20:22 UTC]
-Status: Feedback +Status: Closed -Assigned To: +Assigned To: ab
 [2015-02-23 20:22 UTC]
Thanks for checking, Julien.
 [2015-03-20 14:16 UTC] julientld at free dot fr

This bug (and other related) is not mentioned in the PHP 5.6.7 changelog. It is well fixed in 5.6.7 production version ?

 [2015-03-20 16:57 UTC]
Yes, looks like it's missing in the NEWS, however the code went into release.

 [2015-03-21 10:31 UTC] julientld at free dot fr
Ok, thank you.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Mon Jan 30 12:04:46 2023 UTC