This code causes a segfault of the current php-fpm process:
$result = $stmt->fetch(PDO::FETCH_LAZY);
php-fpm log contains:
[08-Feb-2023 12:26:38] WARNING: [pool www] child 12429 exited on signal 11 (SIGSEGV) after 16.365451 seconds from start
[08-Feb-2023 12:26:38] NOTICE: [pool www] child 12434 started
[08-Feb-2023 12:47:01] WARNING: [pool www] child 12430 exited on signal 11 (SIGSEGV) after 1239.020802 seconds from start
[08-Feb-2023 12:47:01] NOTICE: [pool www] child 12492 started
syslog contains:
Feb 8 12:47:01 pweb1 kernel: [85973.377959] php-fpm7.4[12430]: segfault at 0 ip 0000000000000000 sp 00007ffd018e4d58 error 14 in php-fpm7.4[55a6226d5000+c8000]
Feb 8 12:47:01 pweb1 kernel: [85973.377985] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
Extracts from strace:
11616 1675854217.365979 recvfrom(5, "\1\0\0\1\4-\0\0\2\3def\5provu\5imast\5imast\4item\4item\f!\0E\0\0\0\375\vP\0\0\0;\0\0\3\3def\5provu\5i\mast\5imast\vdescription\vdescription\f!\0\375\2\0\0\374\21\20\0\0\0=\0\0\4\3def\5provu\5imast\5imast\fbox_contents\fbox_contents\f!\0\375\\377\2\0\374\20\0\0\0\0003\0\0\5\3def\5provu\5imast\5imast\7pretail\7pretail\f?\0\f\0\0\0\366\0\0\2\0\0\5\0\0\6\376\0\0\2\0\177\0\0\7\5CP700\L***REDUCED PRICE WHILE STOCKS LAST***Yealink CP700 Portable USB Speakerphone%CP700\r\nTravel case\r\nQuick start guide\595.46\5\0\0\10\376\\0\0\2\0", 32768, MSG_DONTWAIT, NULL, NULL) = 386
11616 1675854217.366447 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
11616 1675854217.368987 +++ killed by SIGSEGV +++
11740 1675854231.431085 recvfrom(5, "\1\0\0\1\4-\0\0\2\3def\5provu\5imast\5imast\4item\4item\f!\0E\0\0\0\375\vP\0\0\0;\0\0\3\3def\5provu\5i\mast\5imast\vdescription\vdescription\f!\0\375\2\0\0\374\21\20\0\0\0=\0\0\4\3def\5provu\5imast\5imast\fbox_contents\fbox_contents\f!\0\375\\377\2\0\374\20\0\0\0\0003\0\0\5\3def\5provu\5imast\5imast\7pretail\7pretail\f?\0\f\0\0\0\366\0\0\2\0\0\5\0\0\6\376\0\0\2\0\36\1\0\7\22BH72-\A-GR-TEAMS-CSnYealink BH72 Bluetooth Dual Teams Edition Ear Piece Headset in Light Gray with Charging Stand and USB-A dongle\224Wireless ch\arging/headset stand\r\nBH72D-TEAMS-GRAY headset\r\nBT51 Bluetooth dongle\r\nUSBA to USBC cable\r\nQuick start guide\r\nCarrying case\r\nPS\U (12V 2A)\006206.67\5\0\0\10\376\0\0\2\0", 32768, MSG_DONTWAIT, NULL, NULL) = 545
11740 1675854231.431563 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
11740 1675854231.434774 +++ killed by SIGSEGV +++
I have a large strace file showing both successful queries and queries that cause the segfault. I will attach this file to this report once submitted as it is too large to paste in-line.
Not all queries result in a segfault but the same ones will cause a segfault every time so I suspect it is something in the results, possibly some NULL values. I have seen old php bugs relating to NULL values with FETCH_LAZY but supposedly fixed in previous php versions.
This same code runs without issue on php7.3 on Debian Buster.
The work around is simply to remove the FETCH_LAZY parameter:
$result = $stmt->fetch();