Vulnerability Development mailing list archives

Re: PHP


From: Ryan Yagatich <ryany () pantek com>
Date: Tue, 19 Nov 2002 14:50:20 -0500 (EST)

Jens,
        Granted this works to keep the memory low, the problem isn't 
really that the php code will segfault, its that the whole apache server 
will shut down. For example, code like this:


class Bar
{
   function Bar
   {
        $global = new Globals;
   }

   # [ ... ]
};
class Globals
{
   function Globals
   {
        $foo = new Bar;
   }
   # [ ... ]
};


will cause an infinite loop and that one apache instance will die and stop 
serving that page. but other php pages elsewhere still work just fine.

With the code that uses more memory than the server permits, instead of 
just that one page that seems to fail, every instance of httpd will die as 
well.... sort of.... the processes are still running but no longer respond 
to signals or connection attempts.

I'm not really worried about _my_ code having issues, that happens 
sometimes, like having 'for ($i=0;$i>0;$i++)', that just sometimes happens 
with every developer, a bug... but what I'm getting at is if some user is 
hosting their website on a production system, that user is granted access 
to php, that users code sets an extremely large memory limit and writes 
really bad code that tries to allocate all of that memory, our production 
server goes bye-bye and our pagers start going nuts.


Thanks,
Ryan Yagatich  <support () pantek com>
        Pantek, Incorporated
 (877) LINUX-FIX - (440) 519-1802
===================================
89 A2 58 B8 3F 18 45 FB 26 98 86 2C
43 EA AC D1 F2 54 D1 DF DC B5 3D 0B
===================================
     A long memory is the most
   subversive idea in America.


On Sat, 16 Nov 2002, Jens Rantil wrote:

Hi Ryan,
Your problem could be solved by calling mysql_unbuffered_query() instead of mysql_query().

Regards,

Jens



Current thread: