libphp.so: oci8.php_oci_cleanup_global_handles segfaults at second call

[lzsiga]

Description

When httpd is terminating, function oci8.php_oci_cleanup_global_handles is sometimes called twice. It symbol ZTS is defined, the second call fails, as the thread specific data-area has already been freed by that time.

Suggested change for php_oci8_int.h
before:

542 #ifdef ZTS
543 #define OCI_G(v) TSRMG(oci_globals_id, zend_oci_globals *, v)
544 #else
545 #define OCI_G(v) (oci_globals.v)
546 #endif

after:

542 #ifdef ZTS
543 # define OCI_GLOBALS TSRMG_BULK(oci_globals_id, zend_oci_globals *)
544 #else
545 # define OCI_GLOBALS (&oci_globals)
546 #endif
547 #define OCI_G(v) (OCI_GLOBALS->v)

Suggested change for oci8.c

before:

246 static void php_oci_cleanup_global_handles(void)
247 {
248     if (OCI_G(err)) {
249         PHP_OCI_CALL(OCIHandleFree, ((dvoid *) OCI_G(err), OCI_HTYPE_ERROR));
250         OCI_G(err) = NULL;
251     }
252
253     if (OCI_G(env)) {
254         PHP_OCI_CALL(OCIHandleFree, ((dvoid *) OCI_G(env), OCI_HTYPE_ENV));
255         OCI_G(env) = NULL;
256     }
257 }

after:

246 static void php_oci_cleanup_global_handles(void)
247 {
248     if (OCI_GLOBALS && OCI_G(err)) {
249         PHP_OCI_CALL(OCIHandleFree, ((dvoid *) OCI_G(err), OCI_HTYPE_ERROR));
250         OCI_G(err) = NULL;
251     }
252
253     if (OCI_GLOBALS && OCI_G(env)) {
254         PHP_OCI_CALL(OCIHandleFree, ((dvoid *) OCI_G(env), OCI_HTYPE_ENV));
255         OCI_G(env) = NULL;
256     }
257 }

or perhaps:

246 static void php_oci_cleanup_global_handles(void)
247 {
248     zend_oci_globals *og= OCI_GLOBALS;
249     if (og) {
250         if (og->err) {
251             PHP_OCI_CALL(OCIHandleFree, ((dvoid *) og->err, OCI_HTYPE_ERROR));
252             og->err = NULL;
253         }
254
255         if (og->env) {
256             PHP_OCI_CALL(OCIHandleFree, ((dvoid *) og->env, OCI_HTYPE_ENV));
257             og->env = NULL;
258         }
259     }
260 }

PHP Version

all with ZTS defined

Operating System

All having pthread

[cmb69]

It seems to me that the problem is the use of the OCI_G macro during GSHUTDOWN, instead of using the passed oci pointer, which would need to be passed to php_oci_cleanup_global_handles().

[cmb69]

@lzsiga, could you please check whether PR #7766 would fix the issue for you?

[lzsiga]

@cmb69 Well, for the first glance I cannot find the check for oci_globals!=NULL in the patch but maybe that's not necessary. Anyways, the problem doesn't occur within a quick start-stop sequence, so I'll let it run for a few days, and will report back. Best wishes.

[lzsiga]

So far so good.