Faulting module name: ODBC32.dll

[dga26]

Hi,
I have posted this bug on php.net portal : https://bugs.php.net/bug.php?id=74710
I can send you more stacktrace or analysis informations from debugdiag or procmon explorer..

The most important to keep is :
i use pdo_sqlsrv pre-release from latest 4.2.0 (https://github.com/Microsoft/msphpsql/releases/tag/v4.2.0-preview) and test many before.

Everytime php-cgi process failed with
Faulting application path: C:\PHP\php-cgi.exe
Faulting module path: C:\Windows\SYSTEM32\ODBC32.dll

Do you have any idea about this bug?

Regards

David

[ulvii]

Hi @dga26 ,

I would suggest to setup a clean VM, try to run the script using php-cli (command line). If the issue still persists, please post the steps to recreate your environment, such as OS, MSODBCSQL version, PHP configure options ( php -i | grep "Configure Command" ) and any other details that you think are relevant.

Please also make sure that, you provide a php script that reproduces the crash.

[dga26]

Hi @ulvii

Thanks for your answer.
Sorry i can't reinstall this clean vm (from customer install))
I send you the php -i result (i replace private data by xxx)

I notice that i try without any other php extension and the problem is the same

The release windows vm is :

php.txt

[dga26]

Php side debug with full informations

[ulvii]

Hi @dga26 ,

1. Are you running into this issue when pdo_sqlsrv is not loaded?
2. Have you tried updating odbc32.dll to make sure that it is not corrupted?
3. When does your application crash? Is there a particular php script that causes the issue? If this a PDO_SQLSRV bug, I will need a repro script to investigate it.

[dga26]

Hi @ulvii

I try with pdo_mysql on MySQL database and no issue.

Have you any link to up odbc32.dll? I search on many ms website but the only package I found was mdac2.8 not ready for win server 2012 r2...

Sure for the last point I agree with you but at this time I am not able to give you a script because it appears when I m clicking along our website randomly but always before a web redirect with header location

[dga26]

I suppose it's related to the end of php script.

The things I tried is to make pure exit after sending headers
When I exit the script it crashed randomly.
When I make a database query after sending headers but before script exit, I never had this issue

A very strange behavior

[ulvii]

@dga26 ,

odbc32.dll is an OS component on newer versions of Windows so there is no separate download for it. If it is damaged, you will need to restore it from backup or the distribution disk.

Please let me know, when you are able to provide a repro script.

[dga26]

@ulvii thanks

i try with another dll without success.

A new step i try is about pdo_sqlsrv log severity (-1)
When i reproduce my issue the last log is 1:
[15-Jun-2017 13:01:04 Europe/Paris] pdo_sqlsrv: entering rshutdown
[15-Jun-2017 13:01:04 Europe/Paris] pdo_sqlsrv_dbh_close: entering
[15-Jun-2017 13:01:04 Europe/Paris] pdo_sqlsrv_stmt_dtor: entering

when no issue the last lines are inverted
[15-Jun-2017 13:01:04 Europe/Paris] pdo_sqlsrv: entering rshutdown
[15-Jun-2017 13:01:04 Europe/Paris] pdo_sqlsrv_stmt_dtor: entering
[15-Jun-2017 13:01:04 Europe/Paris] pdo_sqlsrv_dbh_close: entering

..;any idea?

[dga26]

Hi @ulvii

news from windbg debug ...

the final issue is always the same inside windows log events. more information for you with windbg !analyse step as follow

Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_php-cgi.exe_3e1e5b3cc8993ef1d2fef1733d7c39ddd12296b_1518642f_cab_06a153eb\memory.hdmp]
User Mini Dump File: Only registers, stack and portions of memory are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Version 9600 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 6.3.9600.18217 (winblue_ltsb.160124-0053)
Machine Name:
Debug session time: Wed Jun 21 16:26:44.000 2017 (UTC + 2:00)
System Uptime: 0 days 7:00:54.187
Process Uptime: 0 days 0:07:55.000
................................................................
....................................
Loading unloaded module list
..
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(65c.878): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=32a26c98 edx=00000001 esi=00000003 edi=00000003
eip=77dbc8ac esp=06aae134 ebp=06aae2bc iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
77dbc8ac c21400          ret     14h
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for php_pdo_sqlsrv.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for php7.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for php-cgi.exe - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for msodbcsql13.dll - 

FAULTING_IP: 
odbc32!FreeStmt+2e
6ff928ee 833e03          cmp     dword ptr [esi],3

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 6ff928ee (odbc32!FreeStmt+0x0000002e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 32a26c98
Attempt to read from address 32a26c98

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=00000000 ecx=32a26c98 edx=00000001 esi=00000003 edi=00000003
eip=77dbc8ac esp=06aae134 ebp=06aae2bc iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
77dbc8ac c21400          ret     14h

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

PROCESS_NAME:  php-cgi.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  32a26c98

READ_ADDRESS:  32a26c98 

FOLLOWUP_IP: 
odbc32!FreeStmt+2e
6ff928ee 833e03          cmp     dword ptr [esi],3

NTGLOBALFLAG:  2000000

APPLICATION_VERIFIER_FLAGS:  0

APP:  php-cgi.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

FAULTING_THREAD:  00000878

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ

LAST_CONTROL_TRANSFER:  from 6ffc5eae to 6ff928ee

STACK_TEXT:  
06aaee1c 6ffc5eae 000003ee 1eb31a00 70049e90 odbc32!FreeStmt+0x2e
06aaee64 7004cc1e 00000003 32a26c98 aa4eb313 odbc32!SQLFreeHandle+0x77
WARNING: Stack unwind information not available. Following frames may be wrong.
06aaee94 700562bf aa4eb337 1eb31a00 06aaf840 php_pdo_sqlsrv+0xcc1e
06aaeeb0 70054ab8 70054ab0 70056870 00000000 php_pdo_sqlsrv!get_module+0x11ef
06aaef20 70a6bcea 06aaf840 00000000 56433230 php_pdo_sqlsrv+0x14ab8
06aaef58 707a0e98 00000002 32a3ccc0 00000132 php7!zend_objects_store_del+0xea
06aaef6c 70041ab1 aa4eb213 31f6c800 31ed5ad0 php7!efree+0x78
06aaef80 707a0e98 06aaf840 31ec3a80 aaa5e491 php_pdo_sqlsrv+0x1ab1
06aaef94 70a7cc79 1eb319b8 31f6c800 31f6cc88 php7!efree+0x78
06aaefcc 70b4eb17 0c2531f0 70b4ead0 31f6c800 php7!libiconv_set_relocation_prefix+0x239
06aaefdc 70a9bd89 31f6c800 00000e88 0000009b php7!zend_object_std_dtor+0x47
06aaeff8 707aa781 70e2e244 00000001 00000000 php7!libiconv_set_relocation_prefix+0x1f349
06aaf00c 77687719 06aaf784 06aaf784 06aaf784 php7!zend_ptr_stack_apply+0x2b1
06aaf03c 77e62965 0a650738 0a696eec 77e625e2 KERNELBASE!DeleteTimerQueueTimer+0x22
06aaf068 70f2693a 06aaf090 00000000 00000e88 ntdll!RtlpStdLockRelease+0x14
06aaf0a8 70f277be 06aaf090 00000000 00000e88 verifier!AVrfpDphPostProcessing+0x1a
77e622f0 2118a1ec c08577e8 75ff0974 19e85008 verifier!AVrfpDphFindBusyMemoryAndRemoveFromBusyList+0xbe
77e622fc 19e85008 5d000002 900004c2 90909090 0x2118a1ec
77e62300 5d000002 900004c2 90909090 8b55ff8b 0x19e85008
77e62304 900004c2 90909090 8b55ff8b 18a151ec 0x5d000002
77e62308 90909090 8b55ff8b 18a151ec 8577e821 0x900004c2
77e6230c 8b55ff8b 18a151ec 8577e821 ff0974c0 0x90909090
77e62310 18a151ec 8577e821 ff0974c0 e8500875 0x8b55ff8b
77e62314 8577e821 ff0974c0 e8500875 00000248 0x18a151ec
77e62318 ff0974c0 e8500875 00000248 04c25d59 0x8577e821
77e6231c e8500875 00000248 04c25d59 90909000 0xff0974c0
77e62320 00000000 04c25d59 90909000 90909090 0xe8500875


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  odbc32!FreeStmt+2e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: odbc32

IMAGE_NAME:  odbc32.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  545046b6

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_odbc32.dll!FreeStmt

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_odbc32!FreeStmt+2e

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_c0000005_odbc32.dll!freestmt

FAILURE_ID_HASH:  {b97a4ff8-9008-6025-c994-1b05df6cf082}

Followup: MachineOwner
---------

[dga26]

hi @ulvii

For information
i try today with latest 4.3.0 rc1..same issue

[ulvii]

Hi @dga26 ,

Your application is trying to free a statement that has already been freed. The debug information that you have posted is from Driver Manager, which does not really help me to identify where the issue is happening. I am assuming you downloaded the latest dlls from PECL. You will also find .pdb files inside that package. Please load them with WinDbg and check if you get any SQLSRV related output.

[dga26]

Hi @ulvii

about "php_pdo_sqlsrv!std::`dynamic atexit destructor for '_Fac_tidy_reg''+0xa222"

FAULTING_IP: 
odbc32!FreeStmt+2e
6fbb28ee 833e03          cmp     dword ptr [esi],3

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 6fbb28ee (odbc32!FreeStmt+0x0000002e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 32a32c98
Attempt to read from address 32a32c98

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=00000000 ecx=32a32c98 edx=00000001 esi=00000003 edi=00000003
eip=77dac8ac esp=069ee134 ebp=069ee2bc iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
ntdll!NtWaitForMultipleObjects+0xc:
77dac8ac c21400          ret     14h

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

PROCESS_NAME:  php-cgi.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  32a32c98

READ_ADDRESS:  32a32c98 

FOLLOWUP_IP: 
odbc32!FreeStmt+2e
6fbb28ee 833e03          cmp     dword ptr [esi],3

NTGLOBALFLAG:  2000000

APPLICATION_VERIFIER_FLAGS:  0

APP:  php-cgi.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre

FAULTING_THREAD:  00000c20

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ

LAST_CONTROL_TRANSFER:  from 6fbe5eae to 6fbb28ee

STACK_TEXT:  
069eee20 6fbe5eae 000003ee 338af200 700c0e20 odbc32!FreeStmt+0x2e
069eee68 6fc777e0 00000003 32a32c98 fe49ddf0 odbc32!SQLFreeHandle+0x77
069eee94 6fc85162 fe49dda4 33827280 338af200 php_pdo_sqlsrv!pdo_sqlsrv_stmt_set_attr+0xb0
069eeec0 6fc832a8 338af200 6fc85714 00000000 php_pdo_sqlsrv!std::`dynamic atexit destructor for '_Fac_tidy_reg''+0xa222
069eef28 7038bcea 069ef844 00000000 56433230 php_pdo_sqlsrv!std::`dynamic atexit destructor for '_Fac_tidy_reg''+0x8368
WARNING: Stack unwind information not available. Following frames may be wrong.
069eef5c 700c0e98 fe440e35 069eef98 00000132 php7!zend_objects_store_del+0xea
00000000 00000000 00000000 00000000 00000000 php7!efree+0x78


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  odbc32!FreeStmt+2e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: odbc32

IMAGE_NAME:  odbc32.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  545046b6

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_odbc32.dll!FreeStmt

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_odbc32!FreeStmt+2e

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_c0000005_odbc32.dll!freestmt

FAILURE_ID_HASH:  {b97a4ff8-9008-6025-c994-1b05df6cf082}

Followup: MachineOwner

[Hadis-Fard]

@dga26 This issue could be a potential bug, and we are interested to look closely into it. To be able to proceed with investigation on this issue we need php repo script in the format of <?php your repo script ?>, would you please send us the repo script?

[dga26]

hi @Hadis-Fard, @ulvii

We are in our application using adodb (lens) to interface app and database plugged with pdo_sqlsrv driver.
I remove all __destruct job and register_shutdown_function without success.

I cannot send you the whole application but i'll try to minimize the code to reproduce a very special case...only reproducible by the interface with the same scheme

Thanks for your answers