#18726 [Opn->Bgs]: Empty Argument List Causes PHP to Hang

ID: 18726 Updated by: edink@php.net Reported By: mattmurphy@kc.rr.com -Status: Open +Status: Bogus Bug Type: Performance problem Operating System: Win32 PHP Version: 4.2.2 New Comment: Installation instructions also mention that installing PHP in this way is not very secure. The problem here is that Apache doesn't allow php to be configured as a cgi interpreter outside scripts directory. Again this is *not* a PHP bug. You should configure your Apache web server to use PHP as a module since in that way you avoid the secuirty problems, and increase the performance at the same time. Previous Comments: ------------------------------------------------------------------------ [2002-08-03 16:34:00] mattmurphy@kc.rr.com This *is* an issue, even if it is not a hang problem -- it does appear that way unless something is input via STDIN. SecurityFocus Bug ID #5280 shows how this can be used to cause a DDoS on PHP/Apache pairs... Your own install instructions call for a "/php/" alias to be added on Apache, thus allowing direct calls to the binary. If several of these calls were made, a lengthy period of time would pass before CGI could be used again on the server. PHP should at least add a timeout while waiting for STDIN input, so this is mitigated when used remotely. ------------------------------------------------------------------------ [2002-08-03 16:17:42] edink@php.net PHP will by default read its scripts from STDIN and does not hang. Try typing in something and press Ctrl-Z and you will see PHP executing the "script". Anyway, this is not a correct place for user questions. Please visit http://www.php.net/support for more information. ------------------------------------------------------------------------ [2002-08-03 16:17:24] eru@php.net Forgot to set the status. ------------------------------------------------------------------------ [2002-08-03 16:17:03] eru@php.net No, this is not a bug, as you wouldn't put php.exe in the cgi-bin directory in the first place. Secondly, when called without arguments, php doesn't "hang", but waits for input from the stdin. ------------------------------------------------------------------------ [2002-08-03 16:09:16] mattmurphy@kc.rr.com So, the PHP team is telling me now that something that causes a product to hang, and can be exploited remotely isn't even a *bug*? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/18726 -- Edit this bug report at http://bugs.php.net/?id=18726&edit=1