Bug #51601 [Opn]: Segmentation fault when using the 2-argument form of mysql_fetch_array

Edit report at http://bugs.php.net/bug.php?id=51601&edit=1

 ID:               51601
 User updated by:  pcarter at jhu dot edu
 Reported by:      pcarter at jhu dot edu
 Summary:          Segmentation fault when using the 2-argument form of
                   mysql_fetch_array
 Status:           Open
 Type:             Bug
-Package:          MSSQL related
+Package:          MySQL related
 Operating System: FreeBSD 6.2-RELEASE
 PHP Version:      5.3.2

 New Comment:

I missed on the package dropdown when submitting the bug.  This belongs
with the MySQL package, not the MSSQL package.


Previous Comments:
------------------------------------------------------------------------
[2010-04-19 17:03:06] pcarter at jhu dot edu

Description:
------------
When using the two-argument form of mysql_fetch_array PHP experiences a
segmentation fault in zend_fetch_resource, attempting to dereference a
null pointer. (specifically *passed_id is ((* zval)(0x0)) when
performing the IS_RESOURCE check).  This happens regardless of which of
the three MYSQL_{BOTH|ASSOC|NUM} constants are used as the second
argument (the given script uses MYSQL_BOTH).  This problem does not
occur when using the single argument form of mysql_fetch_array, and it
does not occur when using the mysql_fetch_assoc() or mysql_fetch_row()
functions.

Test environment is FreeSBD 6.2-RELEASE on amd64, with the MySQL 5.0
client library installed.

Test script:
---------------
<?php
    /* Assumuing that these credentials are valid */
    $d = mysql_connect('localhost', 'user', '');
    mysql_select_db('test', $d);
    $r = mysql_query("SHOW TABLES", $d);
    $row = mysql_fetch_array($r, MYSQL_BOTH);
    print_r($row);
?>


Expected result:
----------------
The script should print an array (numerically and associatively indexed)
of the tables in the database "test".

Actual result:
--------------
Segmentation fault as noted above.  Backtrace:

Backtrace:

#0  0x0000000000638ed3 in zend_fetch_resource (passed_id=0x7fffffffce30,
default_id=-1, resource_type_name=0x72fa51 "MySQL result",
found_resource_type=0x0, num_resource_types=1)
    at /usr/local/src/php-5.3.2/Zend/zend_list.c:127
#1  0x00000000004d76a6 in php_mysql_fetch_hash (ht=2,
return_value=0x9240a0, return_value_ptr=0x638ddf, this_ptr=0x0,
return_value_used=1, result_type=3, expected_args=2, into_object=0)
    at /usr/local/src/php-5.3.2/ext/mysql/php_mysql.c:1944
#2  0x00000000004d7c2b in zif_mysql_fetch_array (ht=-12752,
return_value=0xffffffff, return_value_ptr=0x638ddf, this_ptr=0x0,
return_value_used=1) at
/usr/local/src/php-5.3.2/ext/mysql/php_mysql.c:2105
#3  0x000000000064e192 in zend_do_fcall_common_helper_SPEC
(execute_data=0xb45040) at zend_vm_execute.h:313
#4  0x000000000064d5b9 in execute (op_array=0x9248c8) at
zend_vm_execute.h:104
#5  0x000000000062b765 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/local/src/php-5.3.2/Zend/zend.c:1194
#6  0x00000000005d955b in php_execute_script
(primary_file=0x7fffffffeb00) at
/usr/local/src/php-5.3.2/main/main.c:2260
#7  0x00000000006b2bca in main (argc=2, argv=0x7fffffffec00) at
/usr/local/src/php-5.3.2/sapi/cli/php_cli.c:1192




------------------------------------------------------------------------



-- 
Edit this bug report at http://bugs.php.net/bug.php?id=51601&edit=1