From:
Operating system: Ubuntu/CentOS
PHP version: 5.3.2
Package: OCI8 related
Bug Type: Bug
Bug description:Execution of oci_execute arbitrarily causes âInvalid variable
used for bindâ
Description:
------------
1. Run the included SQL to create the package and table on your Oracle
server.
2. Create a script on your Apache server with the sample code.
3. Run the example client, which will generate requests to the Apache
server.
When the script is running it will generate anywhere from 100-500
successful requests before a request results in a PHP error with âInvalid
variable used for bind.â
The failure occurs in oci8_statement.c (oci8 1.4.1) in the
php_oci_bind_pre_exec function. In the switch statement (line 816)
bind->type is referenced. However, in the case when
php_oci_bind_array_by_name is used, only bindp->array.type is set (line
1454) to the input type.
It appears that the php_oci_bind_pre_exec function is not correctly
checking the type, which causes a false negative. The value that should be
checked is dependent upon whether bind_array_by_name or bind_by_name is
initially used.
When this failure occurs and bind->type is incorrectly set,
bind->array.type is the correctly specified bind type.
I am unable to reproduce this issue on the command line.
This was reproduced in two different environments:
Ubuntu 10
OCI8 1.4.1
Oracle 10.2.0.3.0
Apache 2.2.14
gcc 4.4.3
CentOS 5
OCI8 1.4.1
Oracle 11.1.0.7.0
Apache 2.2.3
gcc 4.1.1
Test script:
---------------
/* SQL
CREATE TABLE nums
(
val NUMBER(16) DEFAULT 0 NOT NULL ENABLE
);
INSERT INTO nums VALUES (1);
INSERT INTO nums VALUES (2);
INSERT INTO nums VALUES (3);
INSERT INTO nums VALUES (4);
INSERT INTO nums VALUES (5);
CREATE OR REPLACE PACKAGE NUMBINDPKG AS
PROCEDURE iobind(c1 OUT dbms_sql.number_table);
END NUMBINDPKG;
CREATE OR REPLACE PACKAGE BODY NUMBINDPKG AS
PROCEDURE iobind(c1 OUT dbms_sql.number_table) IS
BEGIN
SELECT val BULK COLLECT INTO c1
FROM nums;
END iobind;
END NUMBINDPKG;
*/
/* Example client
$url = 'http://apacheserver/sample_script.php';
for ($i=0;$i<1000;$i++)
{
$curl = curl_init();
curl_setopt ($curl, CURLOPT_URL, $url);
curl_setopt ($curl, CURLOPT_TIMEOUT, 1);
curl_exec ($curl);
$httpResonseCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close ($curl);
echo "$i: $url ($httpResonseCode)\n";
if ($httpResonseCode!=200) break;
}
*/
/* Start sample_script.php */
<?
$statement = oci_parse($c, "BEGIN NUMBINDPKG.iobind(:c1); END;");
$result = array();
oci_bind_array_by_name($statement, ":c1", $result, 5, 16, SQLT_INT);
$retval = oci_execute($statement);
oci_close($c);
Expected result:
----------------
An error should never occur.
Actual result:
--------------
Approx 1 in every 250 requests result in an âInvalid variable used for
bindâ error, caused by oci_execute.
--
Edit bug report at http://bugs.php.net/bug.php?id=51995&edit=1
--
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51995&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51995&r=trysnapshot53
Try a snapshot (trunk):
http://bugs.php.net/fix.php?id=51995&r=trysnapshottrunk
Fixed in SVN:
http://bugs.php.net/fix.php?id=51995&r=fixed
Fixed in SVN and need be documented:
http://bugs.php.net/fix.php?id=51995&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51995&r=alreadyfixed
Need backtrace:
http://bugs.php.net/fix.php?id=51995&r=needtrace
Need Reproduce Script:
http://bugs.php.net/fix.php?id=51995&r=needscript
Try newer version:
http://bugs.php.net/fix.php?id=51995&r=oldversion
Not developer issue:
http://bugs.php.net/fix.php?id=51995&r=support
Expected behavior:
http://bugs.php.net/fix.php?id=51995&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=51995&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=51995&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51995&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=51995&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=51995&r=dst
IIS Stability:
http://bugs.php.net/fix.php?id=51995&r=isapi
Install GNU Sed:
http://bugs.php.net/fix.php?id=51995&r=gnused
Floating point limitations:
http://bugs.php.net/fix.php?id=51995&r=float
No Zend Extensions:
http://bugs.php.net/fix.php?id=51995&r=nozend
MySQL Configuration Error:
http://bugs.php.net/fix.php?id=51995&r=mysqlcfg
