Edit report at https://bugs.php.net/bug.php?id=71861&edit=1
ID: 71861
Updated by: ab@php.net
Reported by: paul at salesintel dot com
Summary: Buffer Overrun in curl_exec() causing hang
Status: Verified
Type: Bug
Package: cURL related
Operating System: Windows 10 x64
PHP Version: 7.0.4
Block user comment: N
Private report: N
New Comment:
Till now it looks indeed like a libcurl issue, a simple program can reproduce the same behavior https://gist.github.com/weltling/15400de1018c7e6a4b476a415f08768d
. I filed an issue to the upstream on github https://github.com/curl/curl/issues/741 .
Thanks.
Previous Comments:
------------------------------------------------------------------------
[2016-03-30 12:02:14] ab@php.net
I was able to reproduce the hang now. Both latest 5.6 and 7 reproduce, both use libcurl 7.47.1 on
Windows. A step through shows, that where it hangs is curl_easy_perform(), around interface.c:2880
in 7.0;
So how it looks like, it is either a bug or a behavior change in libcurl. 7.48.0 show it as well,
7.42.1 doesn't. I currently don't see any suspicious commits to ext/libcurl that could
cause this regression. Will check with a small C program whether it behaves same.
Thanks.
------------------------------------------------------------------------
[2016-03-28 19:55:12] nikic@php.net
Curl confirmed that these warnings are indirectly caused by openssl, so we can ignore those.
I was not able to reproduce the original issue on Ubuntu 14.04.
I am able to reproduce the hang on Windows, but cannot help beyond that.
------------------------------------------------------------------------
[2016-03-28 17:12:41] paul at salesintel dot com
That it can be reproduced even more simply in both 5 and 7 starts pointing the finger to something
other than the php curl wrapper, should it not still be a bug, or problem, that an exception is
never thrown? That the program just hangs?
------------------------------------------------------------------------
[2016-03-28 15:07:41] nikic@php.net
I've opened an issue at libcurl: https://github.com/curl/curl/issues/734
------------------------------------------------------------------------
[2016-03-28 14:52:35] nikic@php.net
These valgrind warnings are definitely not related to PHP. E.g. this is what I get running curl
directly from the CLI: https://gist.github.com/nikic/b7af10da8f73923a46a0
This does not necessarily mean that there is an issue in curl, as all of this starts with libssl,
which is notoriously valgrind unsafe (don't ask unless you want to hear an answer). However,
given the number of warnings originating in libcurl I'm inclined it doesn't seem unlikely
that there is a genuine issue there.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71861
--
Edit this bug report at https://bugs.php.net/bug.php?id=71861&edit=1