Bug #13455: Using include() with Apache ErrorDocument directive can crash the webserver

From: manitu@manitu.net Operating system: Any Linux with any Apache PHP version: 4.0.6 PHP Bug Type: Apache related Bug description: Using include() with Apache ErrorDocument directive can crash the webserver HOW TO REPRODUCE 1. You must run Apache in any version on a Linux system and have setup an VirtualHost entry with an example domain "www.domain.com". 2. Configure an .htaccess file like ErrorDocument 404 http://www.domain.com/notfound.html 3. The notfound.html file MUST NOT exist and you MUST use an external path 4. Write a php script like <?php include("http://www.domain.com/any_file_that_does_not_exist.html"); ?> WHAT HAPPENS The include() function tries to get the specified document but cannot find it. So the Apache webserver sends an 404 error together with a HTTP redirection. The include() tries to catch this address which leads into an infinite loop. The webserver will die shortly. HOW TO SOLVE The include() function should have a limit on how many levels it tries to catch since the webserver is not able to determine if the caller runs into an infinite loop. -- Edit bug report at: http://bugs.php.net/?id=13455&edit=1