Re: Nasty DoS in PHP

Also win2k and apache(cgi) i got an internal server error, due to the malformed header, CPU usage peaked at 100% and then dropped off. So i changed the code to the loop below and max execution time came up but CPU usage didn't drop straight off, so i had closer look, php exits after 30 seconds but the CPU usage continues in ie and apache and the page keeps loading, so i think that's down to output buffering . interestingly i had no trouble loading phpmyadmin and running a query while this was happening, it was just a little slower...... <?php $a=1; while(0<1) { $a++; echo $a."<br>"; } ?> So if you want to crash your server with an infinite loop there's plenty of ways to do it. <g> Paul Roberts roberts_paul@bigfoot.com ++++++++++++++++++++++++ ----- Original Message ----- From: "Jason Soza" <solja@gci.net> To: "Jason Murray" <Jason.Murray@melbourneit.com.au>; <php-general@lists.php.net> Sent: Thursday, April 18, 2002 7:29 AM Subject: RE: [PHP] Nasty DoS in PHP > Very odd indeed. Well, here's my setup: > Windoze2K > PHP 4.1.2 > Apache 1.3.something > Accessing it via IE 6.0, although this should not have any bearing on > anything > > I'd be interested in knowing your versions and the versions of the first guy > that posted about this. Maybe he has the same setup as me, or close enough, > but both of us are different from you. My browser just kept loading and > loading like all was well, while task manager was skipping all over the > place and I had to wait 5 - 10 seconds after I moved my mouse for the cursor > to move. I timed the script, and after 30 secs, it was still going (although > I stopped it soon thereafter to keep from having to reboot). So I reset > php.ini's execution time limit down to 5 seconds and ran it twice more, and > both times it went well past 5 seconds. > > Of course, none of this bothers me as I won't be putting while(0>1) { > header("A") } into any of my scripts, nor was I ever planning on it! :) > > -----Original Message----- > From: Jason Murray [mailto:Jason.Murray@melbourneit.com.au] > Sent: Wednesday, April 17, 2002 10:13 PM > To: 'Jason Soza'; php-general@lists.php.net > Subject: RE: [PHP] Nasty DoS in PHP > > > > Mine produced the same error message as yours, Jason, but the memory > > and CPU usage continued until I hit the 'stop' button on the browser. > > It seemed to have overridden both time and memory limits, as it had > > racked up 320 megs of my RAM by the time I stopped it. > > It certainly didn't do that here, but it could be a difference between > RAM, PHP and Apache versions (simple paranoia ;)) that causes it. > > PHP clearly sent the error *to my browser* and the browser stopped loading > immediately (thus, the "fatal" error was indeed fatal, and PHP terminated > at that time). > > J > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > >