|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #68329 HTTPS-requests to some servers are blocking until a connection timeout occurs.
Submitted: 2014-10-30 14:40 UTC Modified: 2015-03-04 15:51 UTC
Avg. Score:4.8 ± 0.7
Reproduced:7 of 7 (100.0%)
Same Version:4 (57.1%)
Same OS:4 (57.1%)
From: p dot schillinger at ec-elements dot com Assigned: rdlowrey (profile)
Status: Closed Package: OpenSSL related
PHP Version: 5.6.2 OS: any
Private report: No CVE-ID: None
 [2014-10-30 14:40 UTC] p dot schillinger at ec-elements dot com
Downloading any content over HTTPS with the build-in stream-mechanism does not work as expected with some servers (e.g. Apache 2.4 mod_itk mod_ssl).
The process always blocks until the connection timeout occurs. The return value is correct, however, it takes a long time.

Fetching the same URL with Curl or by bare HTTP works fine.
It affects all versions of PHP.

Test script:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, '');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$t1 = microtime(true);
$output1 = curl_exec($ch);
$t2 = microtime(true);
echo "curl_exec: ".($t2-$t1)." s\n";

$t1 = microtime(true);
$output2 = file_get_contents('');
$t2 = microtime(true);
echo "file_get_contents: ".($t2-$t1)." s\n";

Actual result:
curl_exec: 0.11854910850525 s
file_get_contents: 60.250888824463 s


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2014-10-30 17:43 UTC]
-Status: Open +Status: Verified -Package: HTTP related +Package: OpenSSL related -Assigned To: +Assigned To: rdlowrey
 [2014-10-30 17:43 UTC]
I can reproduce this as well.

Daniel, this feels like something you probably know about. Can you have a look, please?
 [2014-11-05 14:31 UTC]
I haven't had a chance to look at this yet -- have been *really* busy. It may be related to the problems surrounding the attempted fix for that has been haunting me, although those changes were supposed to be held out from the 5.6 branch.

Anyway, will try to find time ASAP to work it out. Thanks for the report.
 [2015-02-02 16:13 UTC] RichParker at nexgenpharma dot com
We ran into this also. But we were working just fine for about a month (Few days short of 30 days). We average about 100K hits per day and resulting in 200-300 transactions per day. Without warning, the usage of file_get_contents just died. Our work around was to go to curl, thanks for that part. We had to revert back to 5.4 (from 5.6.4) which the version we have is not PCI compliant, so I am anxious for a fix for this. We use PHP on our Windows servers. Thank you.
 [2015-03-04 15:51 UTC]
-Status: Verified +Status: Closed
 [2015-03-04 15:51 UTC]
The original offending code was reverted for 5.6.3 (so the issue was "fixed" at that time). New updates have been pushed upstream to resolve the original bug the problematic code attempted to fix:;a=commitdiff;h=fd4641696cc67fedf494717b5e4d452019f04d6f;a=commitdiff;h=1482ed2d5660c3875add40706a18fe29e2b3ff70;a=commitdiff;h=dddbe0fc338a0f01ba336e84755694fb9bfbeb53

Please post a new report if similar behavior is observed going forward.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Tue Dec 05 20:01:30 2023 UTC