Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 456313 - Crash at end of request with OCI8 extension tests
Summary: Crash at end of request with OCI8 extension tests
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: php
Version: 5.2
Hardware: i686
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: Joe Orton
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-07-22 19:05 UTC by Christopher Jones
Modified: 2009-01-20 22:05 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-01-20 22:05:23 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2009:0226 normal SHIPPED_LIVE php bug fix update 2009-01-20 16:06:27 UTC

Description Christopher Jones 2008-07-22 19:05:27 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9) Gecko/2008061015 Firefox/3.0

Description of problem:
Two tests in the PHP OCI8 1.3.3 extension test suite trigger PHP bug 38315.  PHP crashes during the end-of-request shutdown.  In a web environment, no results are returned from the script.

PHP bug 38315 was fixed in PHP 5.2.  Can the patch be backported by RH and released in PHP 4 & 5 RPMs?



Version-Release number of selected component (if applicable):
php-5.1.6-20

How reproducible:
Always


Steps to Reproduce:
Install PHP

    # up2date php php-devel

Download and install Oracle Instant client 'basic' and 'devel' RPMs from
http://www.oracle.com/technology/software/tech/oci/instantclient/index.html

    # rpm -i oracle-instantclient-basic-11.1.0.1-1.i386.rpm oracle-instantclient-devel-11.1.0.1-1.i386.rpm

Download and install Oracle XE database from
http://www.oracle.com/technology/software/products/database/xe/index.html

    # rpm -i oracle-xe-univ-10.2.0.1-1.0.i386.rpm

Configure XE.  (Set the password to "system" in lower case.  Accept
other defaults):

    # /etc/init.d/oracle-xe configure

Download PHP's oci8 1.3.3 extension from PECL
http://pecl.php.net/package/oci8

Build it:

    $ tar -zxf oci8-1.3.3.tgz
    $ cd oci8-1.3.3
    $ phpize
    $ ./configure --with-oci8=shared,instantclient
    $ make

Install it as root:

    # cd oci8-1.3.3
    # make install

Edit /etc/php.ini and add this line:

  extension=oci8.so

Run the testcase:

    cd oci8-1.3.3/tests

No non Oracle testcase has been identified.

Edit oci8-1.3.3/tests/details.inc if you have a different DB password
or connection string.

Run the test:

    $ php cursors.phpt

Actual Results:
At the conclusion of this script after it prints "Done", a trace is
given:

*** glibc detected *** php: free(): invalid next size (fast): 0x0903c120 ***
======= Backtrace: =========
/lib/libc.so.6[0x239b16]
/lib/libc.so.6(cfree+0x90)[0x23d030]
php(shutdown_memory_manager+0x7d)[0x81b5f6d]
php(php_request_shutdown+0x3c1)[0x818f131]
php(main+0x41a)[0x824206a]
/lib/libc.so.6(__libc_start_main+0xdc)[0x1e6dec]
php[0x8075651]
======= Memory map: ========
00101000-00142000 r-xp 00000000 fd:00 8586773    /lib/libssl.so.0.9.8b
00142000-00146000 rwxp 00040000 fd:00 8586773    /lib/libssl.so.0.9.8b
00146000-0016a000 r-xp 00000000 fd:00 11454650   /usr/lib/php/modules/oci8.so
0016a000-0016c000 rwxp 00024000 fd:00 11454650   /usr/lib/php/modules/oci8.so
0016c000-0016d000 r-xp 00000000 fd:00 11441082   /usr/lib/libaio.so.1.0.1
0016d000-0016e000 rwxp 00000000 fd:00 11441082   /usr/lib/libaio.so.1.0.1
0016e000-00175000 r-xp 00000000 fd:00 11437220   /usr/lib/php/modules/dbase.so
00175000-00176000 rwxp 00006000 fd:00 11437220   /usr/lib/php/modules/dbase.so
00176000-0017f000 r-xp 00000000 fd:00 8585289    /lib/libnss_files-2.5.so
0017f000-00180000 r-xp 00008000 fd:00 8585289    /lib/libnss_files-2.5.so
00180000-00181000 rwxp 00009000 fd:00 8585289    /lib/libnss_files-2.5.so
00181000-00185000 r-xp 00000000 fd:00 8585253    /lib/libnss_dns-2.5.so
00185000-00186000 r-xp 00003000 fd:00 8585253    /lib/libnss_dns-2.5.so
00186000-00187000 rwxp 00004000 fd:00 8585253    /lib/libnss_dns-2.5.so
...


Expected Results:
The expected result is no crash at script completion.  cursors.phpt output should conclude with the lines:

bool(false)
bool(true)
Done


Additional info:
The crash also occurs with the equivalent test script cursors_old.phpt.

It occurs on RHEL 4 and 5.

The user workaround is to use oci_free_statement() when each nested cursor is no longer needed.  It may be hard in established scripts to retrofit such a change.

Comment 1 Christopher Jones 2008-07-22 19:07:35 UTC
The patch in
http://cvs.php.net/viewcvs.cgi/ZendEngine2/zend_hash.c?sortdir=down&r1=1.121.2.4&r2=1.121.2.4.2.1
fixes the crash.

Comment 2 Joe Orton 2008-07-23 09:06:37 UTC
Thanks for filing the report!

Comment 3 RHEL Product and Program Management 2008-07-23 09:21:45 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 6 Joe Orton 2008-10-22 10:21:16 UTC
Could you try out these test packages with the oci8 extension, to confirm whether the bug is fixed:

http://people.redhat.com/jorton/Tikanga-php/

Comment 7 Christopher Jones 2008-10-22 16:34:56 UTC
I tested both i386 and x86_64. The two tests complete successfully.  Thank you.

Comment 8 Chris Ward 2008-11-14 13:23:38 UTC
Oracle, a fix for this bug should be available for testing in the RHEL 5.3 Beta release. You can download these bits from RHN.

Please take a moment to verify that the fix is present and functioning as expected and report back your test results as soon as  possible. Thanks! Please ping your Red Hat Partner Manager with any additional questions.

Comment 11 errata-xmlrpc 2009-01-20 22:05:23 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-0226.html


Note You need to log in before you can comment on or make changes to this bug.