php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #6287 serialized script execution with file sessions
Submitted: 2000-08-22 02:25 UTC Modified: 2000-08-23 04:45 UTC
From: omakarenko at cyberplat dot ru Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.1pl2 OS: Linux, FreeBSD
Private report: No CVE-ID: None
 [2000-08-22 02:25 UTC] omakarenko at cyberplat dot ru
Long running php script with active file session blocks other requests from the same client. When the session is started php is trying to flock() the session file and if it is already locked by another process the script (and the whole apache process) hangs (or blocks). So all requests to php pages from the same client are effectivly serialized :( The lock/unlock should be probably placed only around read/write operations. The lock should not be held for the whole script lifetime...

BTW, the flock() is not released at all (!) when php script is called with ?=PHP_LOGO (where PHP_LOGO is a long string of hex digits, see sources)... check the main/main.c... with sessions.auto_start=1 the session IS started before you make PHPWRITE(image/gif) but it is NOT closed on return... That blocks other client's requests for a VERY long time... Just try to show php_info() with auto_start=1 (and expose_php=1 and enabled cookies in you browser)... see that browser is still active trying to download some image (Zend logo actually)... press STOP and shift-Reload... you are blocked... That problem is related to the first one in that while it can be solved different ways the clean solution is to unlock the file after read() and to try to lock the file again only before the write() (write() never happens with ?=PHP_LOGO/ZEND_LOGO/etc trick)...



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-08-23 04:33 UTC] omakarenko at cyberplat dot ru
That bug can be probably used as a DoS attack on any host
 with file sessions... 
 [2000-08-23 04:45 UTC] sas@php.net
Serialization is necessary. Otherwise, we cannot guarantee the integrity of session data. 

The lock gets definitely always released. The program flow is not changed just because we display an image instead of executing the script (see php_execute_script(). It simply returns. After this, any SAPI module will call php_request_shutdown() which calls zend_deactivate_modules() which calls each request shutdown handler.)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Apr 20 02:01:29 2024 UTC