From: bugs dot php dot net at zetafleet dot com
Operating system: Linux (Ubuntu 7.04)
PHP version: 5.2.5
PHP Bug Type: Reproducible crash
Bug description: PDO-ODBC crashes unixODBC due to not binding columns on
"long" data
Description:
------------
PDO-ODBC causes unixODBC to crash when fetching data because it does not
bind all the columns in odbc_stmt.c if there are "long" (data > 256b)
columns, resulting in a NULL pointer dereference in unixODBC at
SQLGetData:472 (line number is for the current CVS version of unixODBC;
release versions may differ. The line is "bound_columns = bound_columns ->
next").
The affected code may be odbc_stmt.c:422-439. I have solved the crash by
commenting out the branch, but this is not the correct solution since it
will now potentially allocate a huge amount of memory.
Reproduce code:
---------------
Create a table in MSSQL like:
CREATE TABLE Frontpage (
ID smallint identity,
Title nvarchar,
SectionUpdate text,
Category nvarchar,
Date smalldatetime,
Link nvarchar );
<?php
$pdo = new PDO('odbc:NewMain', 'imageboston', 'ib86385');
$stmt = $pdo->query('SELECT * FROM Frontpage');
$result = $stmt->fetchAll(PDO::FETCH_NUM);
echo count($result);
?>
Expected result:
----------------
"42" (or however many rows are in the table)
Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47223378858528 (LWP 14883)]
0x00002af315aa93e4 in CLGetData (statement_handle=0xe34f00,
column_number=3, target_type=1, target_value=0xdca8f0, buffer_length=256,
strlen_or_ind=0xdd0420) at SQLGetData.c:472
472 bound_columns = bound_columns -> next;
(gdb) bt
#0 0x00002af315aa93e4 in CLGetData (statement_handle=0xe34f00,
column_number=3, target_type=1, target_value=0xdca8f0, buffer_length=256,
strlen_or_ind=0xdd0420)
at SQLGetData.c:472
#1 0x00002af312debb4e in SQLGetData (statement_handle=0xe34880,
column_number=3, target_type=1, target_value=0xdca8f0, buffer_length=256,
strlen_or_ind=0xdd0420)
at SQLGetData.c:439
#2 0x00002af3138eacd7 in odbc_stmt_get_col (stmt=0xdcfe00, colno=2,
ptr=0x7fffa10faa38, len=0x7fffa10faa30, caller_frees=0x7fffa10faa90)
at
/home/colin/software/source/php5-5.2.1/ext/pdo_odbc/odbc_stmt.c:460
#3 0x00002af313068c35 in fetch_value (stmt=0xdcfe00, dest=0xdd1370,
colno=2, type_override=0x0) at
/home/colin/software/source/php5-5.2.1/ext/pdo/pdo_stmt.c:512
#4 0x00002af31306a2d9 in do_fetch (stmt=0xdcfe00, do_bind=1,
return_value=0xdd1180, how=PDO_FETCH_NUM, ori=PDO_FETCH_ORI_NEXT, offset=0,
return_all=0x0)
at /home/colin/software/source/php5-5.2.1/ext/pdo/pdo_stmt.c:1017
#5 0x00002af31306b9fa in zim_PDOStatement_fetchAll (ht=1,
return_value=0xdcf9b8, return_value_ptr=0x0, this_ptr=0xdcf9e0,
return_value_used=1)
at /home/colin/software/source/php5-5.2.1/ext/pdo/pdo_stmt.c:1494
#6 0x0000000000676642 in ?? ()
#7 0x0000000000666cac in execute ()
#8 0x0000000000647cd3 in zend_execute_scripts ()
#9 0x0000000000606288 in php_execute_script ()
#10 0x00000000006d0960 in main ()
(Please ignore the source version; this problem exists also in 5.2.5
(pdo_odbc hasn't changed) -- I just happened to compile with full debug
information for 5.2.1-0ubuntu1.5.)
--
Edit bug report at http://bugs.php.net/?id=43681&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=43681&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=43681&r=trysnapshot52
Try a CVS snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=43681&r=trysnapshot53
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=43681&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=43681&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=43681&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=43681&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=43681&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=43681&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=43681&r=support
Expected behavior: http://bugs.php.net/fix.php?id=43681&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=43681&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=43681&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=43681&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=43681&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=43681&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=43681&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=43681&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=43681&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=43681&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=43681&r=mysqlcfg
