Bug 456313 - Crash at end of request with OCI8 extension tests
Crash at end of request with OCI8 extension tests
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: php (Show other bugs)
5.2
i686 Linux
low Severity medium
: rc
: ---
Assigned To: Joe Orton
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-22 15:05 EDT by Christopher Jones
Modified: 2009-01-20 17:05 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-01-20 17:05:23 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Christopher Jones 2008-07-22 15:05:27 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9) Gecko/2008061015 Firefox/3.0

Description of problem:
Two tests in the PHP OCI8 1.3.3 extension test suite trigger PHP bug 38315.  PHP crashes during the end-of-request shutdown.  In a web environment, no results are returned from the script.

PHP bug 38315 was fixed in PHP 5.2.  Can the patch be backported by RH and released in PHP 4 & 5 RPMs?



Version-Release number of selected component (if applicable):
php-5.1.6-20

How reproducible:
Always


Steps to Reproduce:
Install PHP

    # up2date php php-devel

Download and install Oracle Instant client 'basic' and 'devel' RPMs from
http://www.oracle.com/technology/software/tech/oci/instantclient/index.html

    # rpm -i oracle-instantclient-basic-11.1.0.1-1.i386.rpm oracle-instantclient-devel-11.1.0.1-1.i386.rpm

Download and install Oracle XE database from
http://www.oracle.com/technology/software/products/database/xe/index.html

    # rpm -i oracle-xe-univ-10.2.0.1-1.0.i386.rpm

Configure XE.  (Set the password to "system" in lower case.  Accept
other defaults):

    # /etc/init.d/oracle-xe configure

Download PHP's oci8 1.3.3 extension from PECL
http://pecl.php.net/package/oci8

Build it:

    $ tar -zxf oci8-1.3.3.tgz
    $ cd oci8-1.3.3
    $ phpize
    $ ./configure --with-oci8=shared,instantclient
    $ make

Install it as root:

    # cd oci8-1.3.3
    # make install

Edit /etc/php.ini and add this line:

  extension=oci8.so

Run the testcase:

    cd oci8-1.3.3/tests

No non Oracle testcase has been identified.

Edit oci8-1.3.3/tests/details.inc if you have a different DB password
or connection string.

Run the test:

    $ php cursors.phpt

Actual Results:
At the conclusion of this script after it prints "Done", a trace is
given:

*** glibc detected *** php: free(): invalid next size (fast): 0x0903c120 ***
======= Backtrace: =========
/lib/libc.so.6[0x239b16]
/lib/libc.so.6(cfree+0x90)[0x23d030]
php(shutdown_memory_manager+0x7d)[0x81b5f6d]
php(php_request_shutdown+0x3c1)[0x818f131]
php(main+0x41a)[0x824206a]
/lib/libc.so.6(__libc_start_main+0xdc)[0x1e6dec]
php[0x8075651]
======= Memory map: ========
00101000-00142000 r-xp 00000000 fd:00 8586773    /lib/libssl.so.0.9.8b
00142000-00146000 rwxp 00040000 fd:00 8586773    /lib/libssl.so.0.9.8b
00146000-0016a000 r-xp 00000000 fd:00 11454650   /usr/lib/php/modules/oci8.so
0016a000-0016c000 rwxp 00024000 fd:00 11454650   /usr/lib/php/modules/oci8.so
0016c000-0016d000 r-xp 00000000 fd:00 11441082   /usr/lib/libaio.so.1.0.1
0016d000-0016e000 rwxp 00000000 fd:00 11441082   /usr/lib/libaio.so.1.0.1
0016e000-00175000 r-xp 00000000 fd:00 11437220   /usr/lib/php/modules/dbase.so
00175000-00176000 rwxp 00006000 fd:00 11437220   /usr/lib/php/modules/dbase.so
00176000-0017f000 r-xp 00000000 fd:00 8585289    /lib/libnss_files-2.5.so
0017f000-00180000 r-xp 00008000 fd:00 8585289    /lib/libnss_files-2.5.so
00180000-00181000 rwxp 00009000 fd:00 8585289    /lib/libnss_files-2.5.so
00181000-00185000 r-xp 00000000 fd:00 8585253    /lib/libnss_dns-2.5.so
00185000-00186000 r-xp 00003000 fd:00 8585253    /lib/libnss_dns-2.5.so
00186000-00187000 rwxp 00004000 fd:00 8585253    /lib/libnss_dns-2.5.so
...


Expected Results:
The expected result is no crash at script completion.  cursors.phpt output should conclude with the lines:

bool(false)
bool(true)
Done


Additional info:
The crash also occurs with the equivalent test script cursors_old.phpt.

It occurs on RHEL 4 and 5.

The user workaround is to use oci_free_statement() when each nested cursor is no longer needed.  It may be hard in established scripts to retrofit such a change.
Comment 1 Christopher Jones 2008-07-22 15:07:35 EDT
The patch in
http://cvs.php.net/viewcvs.cgi/ZendEngine2/zend_hash.c?sortdir=down&r1=1.121.2.4&r2=1.121.2.4.2.1
fixes the crash.
Comment 2 Joe Orton 2008-07-23 05:06:37 EDT
Thanks for filing the report!
Comment 3 RHEL Product and Program Management 2008-07-23 05:21:45 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 6 Joe Orton 2008-10-22 06:21:16 EDT
Could you try out these test packages with the oci8 extension, to confirm whether the bug is fixed:

http://people.redhat.com/jorton/Tikanga-php/
Comment 7 Christopher Jones 2008-10-22 12:34:56 EDT
I tested both i386 and x86_64. The two tests complete successfully.  Thank you.
Comment 8 Chris Ward 2008-11-14 08:23:38 EST
Oracle, a fix for this bug should be available for testing in the RHEL 5.3 Beta release. You can download these bits from RHN.

Please take a moment to verify that the fix is present and functioning as expected and report back your test results as soon as  possible. Thanks! Please ping your Red Hat Partner Manager with any additional questions.
Comment 11 errata-xmlrpc 2009-01-20 17:05:23 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-0226.html

Note You need to log in before you can comment on or make changes to this bug.