Bug #72345 [Opn]: session_start() is not subject to max_execution_time

Edit report at https://bugs.php.net/bug.php?id=72345&edit=1 ID: 72345 User updated by: maggus dot staab at googlemail dot com Reported by: maggus dot staab at googlemail dot com Summary: session_start() is not subject to max_execution_time Status: Open Type: Bug Package: Session related PHP Version: Irrelevant Block user comment: N Private report: N New Comment: I agree that it is a documented/known issue. Like https://bugs.php.net/bug.php?id=72346 it is a very fundamental problem.. The fact that there are a bunch of functions which are not subject to any timeout makes it really easy to abuse/attack php based applications. One just needs to block all available php workers and the website will be unavailble. There are no means in php to protect against such kind of attacks (except you do everything async, but this is not something 99% of php apps will do) Previous Comments: ------------------------------------------------------------------------ [2016-06-06 16:36:58] cmb@php.net It is documented[1] that: | The maximum execution time is not affected by system calls, | stream operations etc. Please see the set_time_limit() function | for more details. So, in my opinion, this is not a bug. [1] <http://php.net/manual/en/info.configuration.php#ini.max-execution-time> ------------------------------------------------------------------------ [2016-06-06 16:12:43] maggus dot staab at googlemail dot com fixed package ------------------------------------------------------------------------ [2016-06-06 15:54:47] maggus dot staab at googlemail dot com Description: ------------ time spent in session_start() is not subject to max_execution_time(). this can cause php to block all its worker processes by waiting for the session_lock, which finally leads to a no longer responding website. shouldn't a process error and exit after max_execution_time-seconds when it is not able to aquire the session lock while session_start()? running with php 5.4 (as this is the most recent version which ubuntu12lts provides) PHP 5.4.45-3+deb.sury.org~precise+1 (cli) (built: Jan 7 2016 15:32:17) Copyright (c) 1997-2014 The PHP Group Zend Engine v2.4.0, Copyright (c) 1998-2014 Zend Technologies with Zend Debugger v6.0.0, Copyright (c) 1999-2013, by Zend Technologies with blackfire v1.10.6, https://blackfire.io, by Blackfireio Inc. Test script: --------------- <?php // run the script 2x concurrently set_time_limit(5); echo "acquire session lock:". time() ."\n"; session_start(); echo "got session lock:". time()."\n"; sleep(10); echo "finished:". time()."\n"; Expected result: ---------------- 1st instance should report >acquire session lock:1465227871 >got session lock:1465227871 >finished:1465227881 2nd instance should error after 5 seconds because session_start() is not able to aquire a session lock within 5 seconds Actual result: -------------- 1st instance reports >acquire session lock:1465227871 >got session lock:1465227871 // LOCK immediately acquired >finished:1465227881 2nd instance reports >acquire session lock:1465227872 >got session lock:1465227881 // LOCK acquired after 1st instance exit'ed >finished:1465227891 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72345&edit=1