bug in SLEEP() function...
| From: | Jason Caldwell | Date: | Sun, 19 May 2002 04:21:12 +0000 |
| Subject: | bug in SLEEP() function... | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-98323@lists.php.net to get a copy of this message | ||
Dunno if this has been mentioned or fixed in the latest release (I'm using
PHP version 4.1.1) -- but, a script will not timeout until the sleep()
function has finished it's duration -- for example:
In my script, if I set "set_time_limit(30)" -- then later in the script I
call a "sleep(45)" -- the script will not timeout until 45 seconds later,
from the point at which the sleep() function was called.
Now, being a conscious programmer -- I'd probably never set my sleep()
function to exceed my default or defined timeout setting. However, the
sleep value can be set via a $var -- and depending on what functions are
performed -- I can see how, when a programmer wants his script to timeout
within a certain amount of time and then it doesn't; can cause a problem --
in-fact, I can foree some sort of sleep-attack whereby a malicious hacker
figures out that a particular script on a particular website has a dynamic
$var for the sleep() function -- then s/he writes a script which calls the
page many times --- "injecting" the $var (say for example:
http://www.whateverweb.goo/home.php?t=65536,
where $t is the time $var in
the script; sleep($t);"
Effectively; in this case, the scripts won't timeout for 18 some hours.
Filling up memory fast.
Just FYI.
Jason