problem with file uploads
| From: | David Wakelin | Date: | Mon, 30 Oct 2000 13:32:10 +0000 |
| Subject: | problem with file uploads | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-22674@lists.php.net to get a copy of this message | ||
Hi,
I've been looking into file uploads and I've found a problem.
If I set upload_max_filesize=20000000 (in php.ini) and I try to upload a 80
Meg file I do get an error but only after the whole 80 Meg has been loaded
into the httpd process (not into a temporary file but into the address space
of the Apache server).
The system I'm running PHP on only has 32 Meg of memory so an 80 Meg process
does it no good at all. I've also tried memory_limit=20000000 (in php.ini)
but that doesn't catch the problem.
This is with php 4.0.1pl2 and 3.0.12 running on RedHat Linux 6.1 and Apache
1.3.12
I think the problem lies in "sapi_read_standard_form_data" from main\SAPI.c.
The function loops around until it has loaded the entire data into memory
before passing it onto the rfc1867 code to reject it with "Max file size of
20000000 bytes exceeded - file [uploadFile]".
This behaviour makes my server susceptible to a denial of service attack
just by uploading a 140 Meg file the system runs out of memory and swap
space and slowly grinds to a halt.
Any comments?
Dave