Bug #75663 [NEW]: file_get_contents() fatal error by php:// wrapper

From: debukuk154 at gmail dot com Operating system: Ubuntu PHP version: 7.0.26 Package: Filesystem function related Bug Type: Bug Bug description:file_get_contents() fatal error by php:// wrapper Description: ------------ Test script: When you trying to input like php:// wrapper, You can see it will error by php://filter/. I don't know why it's occur an error. so i just report this bug now. if it's input by user (i mean, file_get_contents() function), it can be connection by security vulnerability. in case, user are trying input to php://filter/ like that, the user are can make exploit to vuln maliciously. Test script: --------------- auth.php: <?php session_start(); // start session $_SESSION['auth'] = true; // set auth variable to true value file_get_contents("php://filter/"); // file_get_contents is have php://filter/ $_SESSION['auth'] = false; // set auth variable to false value ?> ---------------------------------------- auth_check.php: <?php session_start(); // start session echo $_SESSION['auth']; // print auth variable ?> Expected result: ---------------- It will stop by force. because file_get_contents("php://filter/") are occur an error. Actual result: -------------- This is occur an error and it can be break the code. -- Edit bug report at https://bugs.php.net/bug.php?id=75663&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75663&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75663&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75663&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75663&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75663&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75663&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75663&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75663&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75663&r=support Expected behavior: https://bugs.php.net/fix.php?id=75663&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75663&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75663&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75663&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75663&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75663&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75663&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75663&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75663&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75663&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75663&r=mysqlcfg