Comment 3 for bug 611316

Hi Clint,

I just put another 3 hours into it:

The bug happens in this source code line:

        if(passwd_len>255) {
                passwd[255] = '\0';
        }

of php_mssql_do_connect. I found this out by disassembling the code in the core dump:

Dump of assembler code for function php_mssql_do_connect:
   0x00007f1d4804c330 <+0>: push %r14
   0x00007f1d4804c332 <+2>: push %r13
   0x00007f1d4804c334 <+4>: push %r12
   0x00007f1d4804c336 <+6>: mov %r9d,%r12d
   0x00007f1d4804c339 <+9>: push %rbp
   0x00007f1d4804c33a <+10>: mov %edi,%ebp
   0x00007f1d4804c33c <+12>: push %rbx
   0x00007f1d4804c33d <+13>: mov %rsi,%rbx
   0x00007f1d4804c340 <+16>: lea 0x2ef8(%rip),%rsi # 0x7f1d4804f23f
   0x00007f1d4804c347 <+23>: sub $0xc0,%rsp
   0x00007f1d4804c34e <+30>: mov %fs:0x28,%rax
   0x00007f1d4804c357 <+39>: mov %rax,0xb8(%rsp)
   0x00007f1d4804c35f <+47>: xor %eax,%eax
   0x00007f1d4804c361 <+49>: lea 0x8f(%rsp),%rax
   0x00007f1d4804c369 <+57>: lea 0x88(%rsp),%rcx
   0x00007f1d4804c371 <+65>: lea 0x78(%rsp),%rdx
   0x00007f1d4804c376 <+70>: lea 0x84(%rsp),%r9
   0x00007f1d4804c37e <+78>: lea 0x70(%rsp),%r8
   0x00007f1d4804c383 <+83>: movq $0x0,0x78(%rsp)
   0x00007f1d4804c38c <+92>: mov %rax,0x10(%rsp)
   0x00007f1d4804c391 <+97>: lea 0x80(%rsp),%rax
   0x00007f1d4804c399 <+105>: movq $0x0,0x70(%rsp)
   0x00007f1d4804c3a2 <+114>: movq $0x0,0x68(%rsp)
   0x00007f1d4804c3ab <+123>: movb $0x0,0x8f(%rsp)
   0x00007f1d4804c3b3 <+131>: mov %rax,0x8(%rsp)
   0x00007f1d4804c3b8 <+136>: lea 0x68(%rsp),%rax
   0x00007f1d4804c3bd <+141>: mov %rax,(%rsp)
   0x00007f1d4804c3c1 <+145>: xor %eax,%eax
   0x00007f1d4804c3c3 <+147>: callq 0x7f1d4804a768 <zend_parse_parameters@plt>
   0x00007f1d4804c3c8 <+152>: cmp $0xffffffffffffffff,%eax
   0x00007f1d4804c3cb <+155>: je 0x7f1d4804c7b3 <php_mssql_do_connect+1155>
   0x00007f1d4804c3d1 <+161>: cmpl $0xff,0x88(%rsp)
   0x00007f1d4804c3dc <+172>: jle 0x7f1d4804c3ea <php_mssql_do_connect+186>
   0x00007f1d4804c3de <+174>: mov 0x78(%rsp),%rax
   0x00007f1d4804c3e3 <+179>: movb $0x0,0xff(%rax)
   0x00007f1d4804c3ea <+186>: cmpl $0xff,0x84(%rsp)
   0x00007f1d4804c3f5 <+197>: jle 0x7f1d4804c403 <php_mssql_do_connect+211>
   0x00007f1d4804c3f7 <+199>: mov 0x70(%rsp),%rax
   0x00007f1d4804c3fc <+204>: movb $0x0,0xff(%rax)
   0x00007f1d4804c403 <+211>: cmpl $0xff,0x80(%rsp)
   0x00007f1d4804c40e <+222>: jle 0x7f1d4804c41c <php_mssql_do_connect+236>
   0x00007f1d4804c410 <+224>: mov 0x68(%rsp),%rax
=> 0x00007f1d4804c415 <+229>: movb $0x0,0xff(%rax)
   0x00007f1d4804c41c <+236>: cmp $0x4,%ebp
   0x00007f1d4804c41f <+239>: jbe 0x7f1d4804c7e0 <php_mssql_do_connect+1200>
   0x00007f1d4804c425 <+245>: cmpq $0x0,0x60(%rsp)
   0x00007f1d4804c42b <+251>: lea 0x2e3a(%rip),%rdx # 0x7f1d4804f26c
   0x00007f1d4804c432 <+258>: je 0x7f1d4804c92f <php_mssql_do_connect+1535>
   0x00007f1d4804c438 <+264>: mov 0x206d2a(%rip),%edi # 0x7f1d48253168 <mssql_globals+104>
   0x00007f1d4804c43e <+270>: callq 0x7f1d4804a508 <dbsetlogintime@plt>
   0x00007f1d4804c443 <+275>: mov 0x206d27(%rip),%edi # 0x7f1d48253170 <mssql_globals+112>
   0x00007f1d4804c449 <+281>: callq 0x7f1d4804a468 <dbsettime@plt>
   0x00007f1d4804c44e <+286>: callq 0x7f1d4804a788 <dblogin@plt>

Having this hint, I checked the code of the PHP-script which was:

define ("MSSQL_SERVER", "www");
define ("MSSQL_USER", "xxx");
define ("MSSQL_PASSWORD", "yyy");
define ("MSSQL_DATABASE", "zzz");

mssql_connect(MSSQL_SERVER, MSSQL_USER, MSSQL_PASSWORD);
mssql_select_db(MSSQL_DATABASE);

So there was no error checking. In fact the hostname of the server was wrong, this is why the connection did not succeed. After I fixed the hostname, the code ran without the segmentation fault. It made no difference, if I use "define" or put in the values for the connection als strings.

So the bug is triggered, if the hostname for mssql_connect does not exist.