Bug #68745 [Opn->Csd]: Invalid HTTP requests make web server segfault
Edit report at https://bugs.php.net/bug.php?id=68745&edit=1
ID: 68745
Updated by: aharvey@php.net
Reported by: benjamin dot morel at gmail dot com
Summary: Invalid HTTP requests make web server segfault
-Status: Open
+Status: Closed
Type: Bug
Package: Built-in web server
Operating System: Fedora 21
PHP Version: 5.6.4
-Assigned To:
+Assigned To: aharvey
Block user comment: N
Private report: N
New Comment:
The fix for this bug has been committed.
Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
For Windows:
http://windows.php.net/snapshots/
Thank you for the report, and for helping us make PHP better.
https://github.com/php/php-src/commit/448ef30f75988384b84cdb88bbb3a1a56b9534da
Previous Comments:
------------------------------------------------------------------------
[2015-01-05 00:12:20] benjamin dot morel at gmail dot com
Description:
------------
I'm not sure whether this is a bug in the web server or in PHP itself, but trying to access
$_SERVER when PHP has received an invalid request such as:
GET www.example.com:80 HTTP/1.1
Makes the built-in web server segfault.
Test script:
---------------
1. Create a test.php file containing this line:
<?php print_r($_SERVER);
2. Start the built-in web server on this file:
php -S localhost:8888 test.php
3. Run this PHP code to send an invalid HTTP request:
$fp = fsockopen('localhost', 8888);
fwrite($fp, "GET www.example.com:80 HTTP/1.1\r\n\r\n");
while (! feof($fp)) echo fread($fp, 1024);
fclose($fp);
The web server will segfault.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68745&edit=1
Thread (2 messages)