From: Operating system: Windows Server 2008 x86 PHP version: 5.3.10 Package: PDO related Bug Type: Bug Bug description:Firebird PDO memory corruption
Description: ------------ Running Firebird 2.5, and trying to use PDO to run a few queries, I ran into memory corruption. I've tested the same code on a few other DBMSs via PDO and they run fine, so it seems related to the Firebird PDO module. It also doesn't happen on every table structure. For example, I tried a table consisting of a single integer field and the error wasn't triggered. Playing with the script a bit, it eventually output: zend_mm_heap corrupted The structure for the table in the example script can be found here: https://github.com/phpbb/phpbb3/blob/release- 3.0.10/phpBB/install/schemas/firebird_schema.sql#L1319 Test script: --------------- <?php try { $dbh = new PDO('firebird:host=localhost;dbname=C:\\phpbb_test_data\\tests.fdb', 'SYSDBA', 'masterkey'); for($i = 0; $i < 5000; $i++) { $statement = $dbh->prepare('INSERT INTO "PHPBB_USERS" ("USER_ID", "USERNAME", "USERNAME_CLEAN", "USER_PERMISSIONS", "USER_SIG", "USER_OCC", "USER_INTERESTS") VALUES (?, ?, ?, ?, ?, ?, ?)'); $statement->execute(array (0 => '2', 1 => 'banned', 2 => 'banned', 3 => '', 4 => '', 5 => '', 6 => '')); echo 'Statement run: ' . $i . "\n"; } } catch (PDOException $e) { echo 'Exception: ' . $e->getMessage(); } Expected result: ---------------- The script should run 5000 times and exit cleanly. Actual result: -------------- The script runs through a few iterations and PHP crashes. Altercations to the script can make it run longer or shorter (without trailing ?> crashes in 2 iterations, with it, crashes after 1998 iterations). This first backtrace is from a 32bit Windows Server 2008 install running in a VirtualBox VM: Entry point php!mainCRTStartup Create time 2/25/2012 2:40:53 AM Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.781 Function Arg 1 Arg 2 Arg 3 Source php5ts!zend_mm_set_custom_handlers+225 00000001 0212fa20 0212e7e0 php5ts!_estrndup+35 02130770 00000000 02272f78 php5ts!_zval_copy_ctor_func+42 0212e7e0 00000001 0212f490 php5ts!pdo_stmt_describe_columns+701 00000001 02130810 00000000 php5ts!execute+1130 02160080 02272f01 634b7838 php5ts!execute+15ed 02272f78 0091f440 00000000 php5ts!execute+2e8 0212e548 02272f00 02272f78 php5ts!zend_execute_scripts+fe 00000008 02272f78 00000000 php5ts!php_execute_script+24c 0091f6f0 02272f78 00ee742c php!main+b9b 00000002 02272f08 02271be0 php!memcpy+160 7ffd7000 0091f830 777b1603 kernel32!BaseThreadInitThunk+12 7ffd7000 75823a7e 00000000 ntdll!RtlInitializeExceptionChain+63 00ee3002 7ffd7000 ffffffff ntdll!RtlInitializeExceptionChain+36 00ee3002 7ffd7000 00000000 PHP5TS!ZEND_MM_SET_CUSTOM_HANDLERS+225In php__PID__4908__Date__02_25_2012__Time_02_41_07AM__420__Second_Chance_Exception_ C0000005.dmp the assembly instruction at php5ts!zend_mm_set_custom_handlers+225 in C:\php\php5ts.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x6e6e616a on thread 0 Module Information Image Name: C:\php\php5ts.dll Symbol Type: PDB Base address: 0x63490000 Time Stamp: Thu Feb 02 13:36:49 2012 Checksum: 0x005a3fb6 Comments: COM DLL: False Company Name: The PHP Group ISAPIExtension: False File Description: PHP Script Interpreter ISAPIFilter: False File Version: 5.3.10 Managed DLL: False Internal Name: PHP Script Interpreter VB DLL: False Legal Copyright: Copyright © 1997-2010 The PHP Group Loaded Image Name: php5ts.dll Legal Trademarks: PHP Mapped Image Name: Original filename: php5ts.dll Module name: php5ts Private Build: Single Threaded: False Product Name: PHP Module Size: 5.77 MBytes Product Version: 5.3.10 Symbol File Name: C:\php_debug\php5ts.pdb Special Build: & Moving it to my main system, Windows 7 x64 (32bit Firebird 2.5 still), with Visual Studio 2010, I captured the following stack trace when it crashed: php5ts.dll!_zend_mm_alloc_int(_zend_mm_heap * heap=0x6e6e6162, unsigned int size=1) Line 1835 php5ts.dll!_estrndup(const char * s=0x02cb1308, unsigned int length=0) Line 2503 + 0x33 bytes php5ts.dll!_zval_copy_ctor_func(_zval_struct * zvalue=0x02cb1d80) Line 120 + 0xc bytes php5ts.dll!zim_PDOStatement_execute(int ht=1, _zval_struct * return_value=0x02cb1028, _zval_struct * * return_value_ptr=0x00000000, _zval_struct * this_ptr=0x02cb1088, int return_value_used=0, void * * * tsrm_ls=0x02c91ad0) Line 478 + 0x3f bytes php5ts.dll!zend_do_fcall_common_helper_SPEC(_zend_execute_data * execute_data=0x02ce0080, void * * * tsrm_ls=0x02c91a01) Line 320 + 0x41 bytes php5ts.dll!ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER(_zend_execute_data * execute_data=0x00000000, void * * * tsrm_ls=0x00000001) Line 426 php5ts.dll!execute(_zend_op_array * op_array=0x02caee80, void * * * tsrm_ls=0x02c91a00) Line 107 + 0xa bytes php5ts.dll!zend_execute_scripts(int type=8, void * * * tsrm_ls=0x02c91ad0, _zval_struct * * retval=0x00000000, int file_count=3, ...) Line 1237 php5ts.dll!php_execute_script(_zend_file_handle * primary_file=0x010afc84, void * * * tsrm_ls=0x02c91ad0) Line 2308 + 0x12 bytes php.exe!main(int argc=2, char * * argv=0x02c92fa8) Line 1185 php.exe!__tmainCRTStartup() Line 586 + 0x17 bytes kernel32.dll!7646339a() [Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll] ntdll.dll!770a9ef2() ntdll.dll!770a9ec5() -- Edit bug report at https://bugs.php.net/bug.php?id=61183&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=61183&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=61183&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=61183&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=61183&r=fixed Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=61183&r=needdocs Fixed in release: https://bugs.php.net/fix.php?id=61183&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=61183&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=61183&r=needscript Try newer version: https://bugs.php.net/fix.php?id=61183&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=61183&r=support Expected behavior: https://bugs.php.net/fix.php?id=61183&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=61183&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=61183&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=61183&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=61183&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=61183&r=dst IIS Stability: https://bugs.php.net/fix.php?id=61183&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=61183&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=61183&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=61183&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=61183&r=mysqlcfg
