Bug #64014 [Com]: 10 second delay in returning file_get_contents('php://input')

Edit report at https://bugs.php.net/bug.php?id=64014&edit=1 ID: 64014 Comment by: mike dot sherov at gmail dot com Reported by: dagan at digitalconversations dot tv Summary: 10 second delay in returning file_get_contents('php://input') Status: Not a bug Type: Bug Package: Apache2 related Operating System: ubuntu 12+ PHP Version: 5.3.21 Block user comment: N Private report: N New Comment: > This is not a bug in PHP, it's a bug in the client that sent the incorrect Content-Length header. I would imagine this to be a security vulnerability akin to a slowloris attack. The "client" sending the incorrect header can be malicious. How do we address this bug? See here for more info / PoC code http://stackoverflow.com/questions/14295901/php-file-get-contentsphp-input-very-slow Previous Comments: ------------------------------------------------------------------------ [2013-01-24 13:03:50] krakjoe@php.net This is not a bug in PHP, it's a bug in the client that sent the incorrect Content-Length header. ------------------------------------------------------------------------ [2013-01-17 23:29:48] dagan at digitalconversations dot tv Description: ------------ If an invalid Content-Length header is sent with a request, attempting to read the request body via file_get_contents('php://input') results in a delay of 10 seconds while, I assume, a timeout is waited on. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=64014&edit=1