|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2007-06-26 12:59 UTC] sniper@php.net
[2007-06-26 13:13 UTC] bugs-php at misc dot lka dot org dot lu
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Nov 02 12:00:01 2025 UTC |
Description: ------------ Right now, an untrusted user can write a PHP script that seriously impacts a server by filling up its log file. Even the ignore_repeated_errors settings doesn't help here, if the script alternates between two messges. We had this happen here accidentally, using a construct such as follows: $fp=fopen($website,"r"); while (!feof($fp)) { .... } where the test whether $fp was a valid file handle was forgotten... And log_errors_max_len didn't help either; apparently this covers the length of an individual log entry, rather than multiple log entries issued by the same script invocation. In order to solve this issue, would it be possible to have one of the following solutions: 1. A max_log_lines quota which would just stop logging if reached. 2. A max_log_lines_kill quota, which would kill the script if reached 3. Some mandatory wait after each log line, to slow down the filling up of the log Reproduce code: --------------- <?php $website="http://www.ruthe.de/strip/strip.pl"; $fp=fopen($website,"r"); // or die ("Cannot open url"); $bild="null"; while (!feof($fp)) { $a = ereg("img/strip_[0-9]+.jpg",fgets($fp,1024),$bild); } $url="http://www.ruthe.de/strip/".$bild[0]; //print "ruthe.de=$url"; fclose($fp); ?> Expected result: ---------------- Script fails, but machine stays up Actual result: -------------- Apache error_log file fills up /var partition until machine crashes and burns...