Bug #75760 [NEW]: The php development server crashes on GET/POST request with huge Content-Length

From: speirofr at gmail dot com Operating system: Ubuntu 16 PHP version: 7.0.27 Package: Built-in web server Bug Type: Bug Bug description:The php development server crashes on GET/POST request with huge Content-Length Description: ------------ The PHP development server crashes when a GET/POST request is performed with a huge Content-Length header, as the PHP server attempts to allocate the memory requested by the client (same as https://bugs.php.net/bug.php?id=61461). The steps to reproduce the bug are provided in the Test Script, on the PHP debian package php7.0 (7.0.22-0ubuntu0.16.04.1), as well as on previous PHP versions starting with PHP5 (php 5.6.30). Test script: --------------- # start php development server ! pgrep '^php$' && php -S 127.0.0.1:8080 & sleep 1 # send GET/POST request with huge content-length nc 127.0.0.1 8080 <<EOF GET / HTTP/1.1 User-Agent: PHP-Test-Env/1.2 Accept: */* Host: 127.0.0.1:8080 Connection: Keep-Alive Content-Length: 555555555555555 test EOF # the php development server crashes ! pgrep '^php$' && echo 'Test FAIL: The PHP server crashed' Expected result: ---------------- The PHP server should not crash when a client issues a HTTP request with an invalid Content-Length. Actual result: -------------- The output observed when executing the Test Script is: php -S 127.0.0.1:8080 PHP 7.0.22-0ubuntu0.16.04.1 Development Server Listening on http://127.0.0.1:8080 Document root is /tmp Press Ctrl-C to quit. Out of memory Debugging the PHP server shows that the malloc that runs out of memory is performed at php_cli_server_client_read_request_on_body: (gdb) bt 59 #0 __GI___libc_malloc (bytes=34359738368) at malloc.c:2902 60 #1 0x00000000008350e9 in __zend_malloc (len=34359738368) at php-src/Zend/zend_alloc.c:2884 61 #2 0x0000000000911d69 in php_cli_server_client_read_request_on_body (parser=<optimized out>, at=0x7fffffff8767 63 -- Edit bug report at https://bugs.php.net/bug.php?id=75760&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75760&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75760&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75760&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75760&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75760&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75760&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75760&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75760&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75760&r=support Expected behavior: https://bugs.php.net/fix.php?id=75760&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75760&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75760&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75760&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75760&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75760&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75760&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75760&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75760&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75760&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75760&r=mysqlcfg