msphpsql: fetch cause memory corruption

• Error in `/usr/bin/php’: malloc(): memory corruption: 0x000055555620b500 * ======= Backtrace: ========= /lib64/libc.so.6(+0x7dd4d)[0x7ffff4c30d4d] /lib64/libc.so.6(__libc_malloc+0x4c)[0x7ffff4c32fbc] /usr/bin/php(__zend_malloc+0x9)[0x5555557c9029] /usr/bin/php(_zend_hash_str_update+0x31)[0x555555800901] /usr/bin/php(add_assoc_zval_ex+0x3e)[0x5555557f5dce] /usr/lib64/php/modules/sqlsrv.so(+0x172ee)[0x7fffed0d72ee] /usr/lib64/php/modules/sqlsrv.so(_Z22zif_sqlsrv_fetch_arrayP18_zend_execute_dataP12_zval_struct+0x15f)[0x7fffed0da1df] /usr/lib64/php/modules/xdebug.so(xdebug_execute_internal+0x2ed)[0x7fffed31683d] /usr/bin/php(+0x338220)[0x55555588c220] /usr/bin/php(execute_ex+0x2b)[0x55555583a79b] /usr/lib64/php/modules/xdebug.so(xdebug_execute_ex+0x30e)[0x7fffed315cee] /usr/bin/php(+0x33858a)[0x55555588c58a] /usr/bin/php(execute_ex+0x2b)[0x55555583a79b] /usr/lib64/php/modules/xdebug.so(xdebug_execute_ex+0x30e)[0x7fffed315cee] /usr/bin/php(+0x33858a)[0x55555588c58a] /usr/bin/php(execute_ex+0x2b)[0x55555583a79b] /usr/lib64/php/modules/xdebug.so(xdebug_execute_ex+0x30e)[0x7fffed315cee] /usr/bin/php(zend_execute+0x194)[0x55555588e584] /usr/bin/php(zend_execute_scripts+0xc3)[0x5555557f2dd3] /usr/bin/php(php_execute_script+0x2d8)[0x555555790318] /usr/bin/php(+0x33c828)[0x555555890828] /usr/bin/php(+0xd149f)[0x55555562549f] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff4bd4b35] /usr/bin/php(+0xd153a)[0x55555562553a]

(gdb) bt #0 0x00007ffff4be81d7 in __GI_raise (sig=sig@entry=6) at …/nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff4be98c8 in __GI_abort () at abort.c:90 #2 0x00007ffff4c27f07 in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffff4d32b88 "*** Error in `%s’: %s: 0x%s \n") at …/sysdeps/unix/sysv/linux/libc_fatal.c:196 #3 0x00007ffff4c30d4d in malloc_printerr (ar_ptr=0x7ffff4f6d760 <main_arena>, ptr=0x5555561f9eb0, str=0x7ffff4d3029e “malloc(): memory corruption”, action=<optimized out>) at malloc.c:5013 #4 _int_malloc (av=av@entry=0x7ffff4f6d760 <main_arena>, bytes=bytes@entry=296) at malloc.c:3461 #5 0x00007ffff4c32fbc in __GI___libc_malloc (bytes=296) at malloc.c:2893 #6 0x00005555557c9029 in ?? () #7 0x00005555561f9da0 in ?? () #8 0x00007fffed0d6c26 in (anonymous namespace)::convert_to_zval(sqlsrv_stmt, SQLSRV_PHPTYPE, void, long, _zval_struct&) [clone .isra.4] () from /usr/lib64/php/modules/sqlsrv.so #9 0x00007fffed0d7373 in (anonymous namespace)::fetch_fields_common(ss_sqlsrv_stmt, long, _zval_struct&, bool) () from /usr/lib64/php/modules/sqlsrv.so #10 0x00007fffed0da1df in zif_sqlsrv_fetch_array(_zend_execute_data*, _zval_struct*) () from /usr/lib64/php/modules/sqlsrv.so #11 0x00007fffed31683d in xdebug_execute_internal () from /usr/lib64/php/modules/xdebug.so #12 0x000055555588c220 in ?? () #13 0x0000555555ffbee8 in ?? () #14 0x0000555555ffbee8 in ?? () #15 0x00007ffff7e9c0d0 in ?? () #16 0x0000000000000000 in ?? ()

valgrind: m_mallocfree.c:277 (mk_plain_bszB): Assertion ‘bszB != 0’ failed. valgrind: This is probably caused by your program erroneously writing past the end of a heap block and corrupting heap metadata. If you fix any invalid writes reported by Memcheck, this assertion failure will probably go away. Please try that before reporting this as a bug.

host stacktrace: ==10846== at 0x3803D208: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3803D334: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3803D4C1: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x38048B2A: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x38049642: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3804B1A4: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3800B5D4: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3800B7A7: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3808D7C5: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux) ==10846== by 0x3809BF8A: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)

sched status: running_tid=1

Thread 1: status = VgTs_Runnable (lwpid 10846) ==10846== at 0x4C28BE3: malloc (vg_replace_malloc.c:299) ==10846== by 0x37D028: __zend_malloc (in /usr/bin/php) ==10846== by 0xFD20C25: (anonymous namespace)::convert_to_zval(sqlsrv_stmt*, SQLSRV_PHPTYPE, void*, long, _zval_struct&) [clone .isra.4] (in /usr/lib64/php/modules/sqlsrv.so) ==10846== by 0xFD21372: (anonymous namespace)::fetch_fields_common(ss_sqlsrv_stmt*, long, _zval_struct&, bool) (in /usr/lib64/php/modules/sqlsrv.so) ==10846== by 0xFD241DE: zif_sqlsrv_fetch_array(_zend_execute_data*, _zval_struct*) (in /usr/lib64/php/modules/sqlsrv.so) ==10846== by 0xFADD83C: xdebug_execute_internal (in /usr/lib64/php/modules/xdebug.so) ==10846== by 0x44021F: ??? (in /usr/bin/php) ==10846== by 0x3EE79A: execute_ex (in /usr/bin/php) ==10846== by 0xFADCCED: xdebug_execute_ex (in /usr/lib64/php/modules/xdebug.so) ==10846== by 0x440589: ??? (in /usr/bin/php) ==10846== by 0x3EE79A: execute_ex (in /usr/bin/php) ==10846== by 0xFADCCED: xdebug_execute_ex (in /usr/lib64/php/modules/xdebug.so) ==10846== by 0x440589: ??? (in /usr/bin/php) ==10846== by 0x3EE79A: execute_ex (in /usr/bin/php) ==10846== by 0xFADCCED: xdebug_execute_ex (in /usr/lib64/php/modules/xdebug.so) ==10846== by 0x442583: zend_execute (in /usr/bin/php) ==10846== by 0x3A6DD2: zend_execute_scripts (in /usr/bin/php) ==10846== by 0x344317: php_execute_script (in /usr/bin/php) ==10846== by 0x444827: ??? (in /usr/bin/php) ==10846== by 0x1D949E: ??? (in /usr/bin/php) ==10846== by 0x7CBDB34: (below main) (libc-start.c:274)