Segmentation fault in PHP5 with pgsql module

It looks like something similar was already here one year ago...

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542514

I tried recompile php without the suhosin patch and it is still segfaulting.

See the *notice in frame #2 "address is out of bounds" (in function _php_pgsql_notice_ptr_dtor)

This bug look very similar to php5 bug #542514 which was found in 5.2.10 and fixed in 5.2.11.

I think I've found the problem. It is in the pgsql extension. The memory for the notices is allocated as non persistent but the whole structure is persistent. The destructor tries to free memory that was already cleaned by the garbage collector which causes the segmentation fault. I've created a simple patch and it works for me now.

Thanks for the patch. Ill submit this patch upstream.

chuck

Your welcome. I've submited the patch to PHP already, see http://bugs.php.net/bug.php?id=52389 because we've detected this bug in Mac and Windows as well.

This bug was fixed in the package php5 - 5.3.3-1ubuntu4

---------------
php5 (5.3.3-1ubuntu4) maverick; urgency=low

  * debian/php5-module.ini: # replaced with ; (LP: #591286)
  * debian/patches/php52389-pgsql-segfault.patch (LP: #607646)
    - Applying patch for upstream bug that causes segfaults in pgsql
 -- Clint Byrum <email address hidden> Fri, 13 Aug 2010 00:07:15 -0700

Miroslav, this is fixed in Maverick, and it is probably a reasonable candidate for SRU to Lucid.

However, I haven't seen your response in the upstream bug to the PHP developers asking for a clear test case.

Until somebody has provided them with a test case there, I don't think we should move forward with an SRU.

I just upgraded to Maverick this morning and this patch has broken pgsql quite badly. The following code now causes PHP to silently die (with valid connection details):

$conn = pg_connect($details);
pg_last_error($conn);

This caused my MediaWiki installation to suddenly stop working. I've rebuilt the package without this patch (php52389-pgsql-segfault.patch) and everything works fine again. Can I suggest reverting the patch until a test case for the original bug exists?

Hi JamesL, thanks for the heads up, and I am sorry that you are experiencing problems.

Can you please open a new bug report for this? Any details you can provide would be very helpful. Specifically:

* A repeatable test case (I'm installing mediawiki now to give it a go, but if you have something smaller that would be great)
* A coredump (if so, make it a private bug report)
* A backtrace with debug symbols (apt-get install php5-dbg)

After you create the bug report, if you could subscribe me, that would be appreciated.

BTW, I suspect this is the issue JamesL was reporting here:

https://bugs.launchpad.net/ubuntu/+source/php5/+bug/660227

It does seem logical to remove this patch, as Miroslav has failed to produce a reproducible test case.

An updated php5 was just uploaded to maverick-proposed which reverts this patch, see bug 660227. Can you please check if the original crash here is still an issue with that?

A colleague of mine, Jaromir, provided a fixed patch and reproducible test case. Please check the main stream bug report http://bugs.php.net/bug.php?id=52389 for details