php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37679 Fork bomb with system() and exec()
Submitted: 2006-06-02 13:59 UTC Modified: 2006-06-04 09:21 UTC
Votes:2
Avg. Score:4.5 ± 0.5
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: mdon at names dot co dot uk Assigned:
Status: Not a bug Package: CGI/CLI related
PHP Version: 4.4.2 OS: CentOS 4.2
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: mdon at names dot co dot uk
New email:
PHP Version: OS:

 

 [2006-06-02 13:59 UTC] mdon at names dot co dot uk
Description:
------------
Forking a process to run a second PHP script using 
system() or exec() creates a fork bomb in CGI version of 
PHP 4.4.2. This appears to be due to the 
$PATH_TRANSLATED environment variable not being cleared 
correctly and is reproducible from the command line.

Reproduce code:
---------------
test1.php:
<?php system("php -q test2.php")?>

test2.php
<?php echo "hello, i'm test2.php\n"?>

Expected result:
----------------
When test1.php is run via a web server or from the 
command line, I would expect to just see the output of 
test2.php.



Actual result:
--------------
Running test1.php via a web server (Zeus 4.3r2 in our 
case) creates a fork bomb, which looks like this in ps:

17522 2:49  \_ zeus.cgi
16666 0:00  |   \_ php
16668 0:00  |   |   \_ php -q test2.php
16670 0:00  |   |       \_ php -q test2.php
16672 0:00  |   |           \_ php -q test2.php
16674 0:00  |   |               \_ php -q test2.php
16676 0:00  |   |                   \_ php -q test2.php

...etc...

With some help from the Zeus developers, we have 
determined that this appears to be due to the 
$PATH_TRANSLATED environment variable not being cleared 
correctly. This can be replicated from the command line 
as follows:

export PATH_TRANSLATED="test1.php"; php test1.php

PHP was configured with the following options:

./configure --prefix=/usr/local --enable-bcmath --with-
freetype-dir --enable-ftp --with-mysql=/usr --with-
mssql=/usr/local --with-mcrypt=/usr/local/lib/libmcrypt 
--with-zlib-dir=/usr/local --with-pspell --with-curl --
with-imap=/usr/local/imap-2002e --with-gd --with-jpeg-
dir --with-png-dir --with-libdir=/usr/lib --with-ttf --
with-xml --enable-xslt --with-xslt-sablot --with-sablot-
js --enable-mbstring --with-config-file-path=/usr/local/
bin --with-pear --with-openssl

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-06-04 09:21 UTC] edink@php.net
This is expected behaviour of the cgi sapi. You are supposed to used cli version of PHP to execute command line scripts. Avoiding problems like this was one of the reasons cli version of PHP was made in the first place.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Oct 31 22:01:27 2024 UTC