php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #30463 popen crashes webservers
Submitted: 2004-10-17 08:17 UTC Modified: 2004-10-21 23:18 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: terrafrost at gmail dot com Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4.3.9 OS: Windows XP
Private report: No CVE-ID: None
 [2004-10-17 08:17 UTC] terrafrost at gmail dot com
Description:
------------
When run from a webserver, the following two scripts cause the webserver to crash.  In contrast, no such problem occurs when these scripts are run from the command line.

Reproduce code:
---------------
ptest.php:
<?
   $p1 = popen("c:\\php\\php -q hello.php","r");
   $p2 = popen("c:\\php\\php -q hello.php","r");
   while (!feof($p1))
      print fgets($p1);
   while (!feof($p2))
      print fgets($p2);
   pclose($p1);
   pclose($p2);
?>

and

hello.php:
<?
   print "hello,\nworld!\n";
?>

Expected result:
----------------
I expect the following to be displayed:

hello,
world!
hello,
world!

Actual result:
--------------
When run from the command line, the expected result is the actual result.  However, when run from a webserver (I tried Apache 2.0.52 and Abyss Web Server 1.2.3.0) they create a bunch of php and cmd processes (more than it should) and none of them are terminated.

In the case of Apache, processes are no longer created after the first 10 or so are.  Afterwards, trying to view php scripts, with Apache, causes an Internal Server Error.  

In the case of Abyss, processes are no longer created when the system has run out of ram.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-10-17 08:21 UTC] terrafrost at gmail dot com
The problem also seems to effect proc_open...
 [2004-10-21 23:18 UTC] wez@php.net
Running the CGI version of PHP from within a web server will pick up the CGI env vars and ignore your command line parameters, leading to the fork bomb effect you have described.
You need to fix your script to call the CLI version of PHP instead.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 10:01:28 2024 UTC