ID: 40273
User updated by: Jenei dot Viktor dot Attila at stud dot u-szeged dot
hu
Reported By: Jenei dot Viktor dot Attila at stud dot u-szeged dot
hu
Status: Bogus
Bug Type: Performance problem
Operating System: Win32, Linux
PHP Version: 5.2.0
New Comment:
But no time limit when you use third party library? (php interpreter
don't count the time?)
Previous Comments:
------------------------------------------------------------------------
[2007-01-29 13:36:31] [EMAIL PROTECTED]
bcmath extension uses libbcmath, which actually does those math
operations and we apparently cannot fix or improve this third-party
library.
There were no changes in ext/bcmath for years, so I doubt that it's
appeared in 5.2.0.
Not PHP problem.
------------------------------------------------------------------------
[2007-01-29 13:29:22] Jenei dot Viktor dot Attila at stud dot u-szeged
dot hu
Description:
------------
In the bcmatch module can found a function called bcpow. If you called
this with a big exponent, the compute will take a long. If you load
this
script many times, the system will hang up. The set_time_limit value
don't
help, because it is not an interpreted code.
This code only usefull, if the attacker want to reboot/halt the server
by
the administrator.
Reproduce code:
---------------
denial_of_service.php:
<?php
echo bcpow(9,9999999);
?>
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=40273&edit=1
