From: kmb at deam dot org
Operating system: Debian-Linux (Woody), MacOS X.3
PHP version: Irrelevant
PHP Bug Type: Apache related
Bug description: DenialOfService-Risk with wrong Usage
Description:
------------
Calling somith within a PHP-Script recursively can result into one of
these results:
1. general PHP-error and stop
2. max_execution_time and stop
3. max_input_time and stop
4. memory_limit and stop
If you use the file()-function to call yourself, one of the upper limits
will occure, but it won't stop with that.
You can overload the Apache with a lot of reqeusts so that there will be
no more response. Your initial request will timeout, but the Apache won't
come back if you do not restart it.
The trouble is, that there is currently no way to suppress this behaviour
or at least leave some resources open....
Reproduce code:
---------------
$in = file("http://local.dom/myself.php";, "r");
Expected result:
----------------
some sort of "filter" to slow down the request of resource-usage.
Actual result:
--------------
It uses up all Apache-processes up to MaxClient-Limit and ends in a total
DOS of the Apache.
--
Edit bug report at http://bugs.php.net/?id=27004&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=27004&r=trysnapshot4
Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=27004&r=trysnapshot5
Fixed in CVS: http://bugs.php.net/fix.php?id=27004&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=27004&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=27004&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=27004&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=27004&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=27004&r=support
Expected behavior: http://bugs.php.net/fix.php?id=27004&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=27004&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=27004&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=27004&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=27004&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=27004&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=27004&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=27004&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=27004&r=float
