Posted by Sander Holthaus - Orange XL on 02/07/05 16:01

I'm running Apache 2.0.52 and PHP 5.03 in a jailed (Virtual Private Server)
FreeBSD 4.10 envirorement. PHP 5.03 is running as php_mod and was installed
quite recently. Since then (better, since someone started using it) I've
been getting these errors in the httpd-error log:

Allowed memory size of 8388608 bytes exhausted (tried to allocate 79 bytes)

And this one in the php-error log:

[06-Feb-2005 17:25:50] PHP Fatal error: Allowed memory size of 8388608
bytes exhausted (tried to allocate 6587593 bytes) in
xxx/xxx/xxx/xxx/xxx/xxx.php on line 53

I also see several thousands of notices in the PHP-error log within the
time-frame of a single second, plus diveded by zero, etc.

Of course, I asked the programmer to fix all of these issues.Among others,
there was a script that outputted a html-form with 2 columns, 100 rows each
containing select-boxes with 100 full names (and those 100 names were the
same of every column/row in that form :-|).

But the problem is not so much that someone is using broken and the most
inefficient scripts, but more that they are crashing the entire box!

When these scripts are run, the box becomes totally unresponsive, afterwards
all cgi and php request to Apache fail with a 500 error and sometimes the
whole box crashes completely, apparently from memory exhaustion. :-(

It this a bug somewhere in PHP, Apache or FreeBSD?

How can I protect myself against this? I can't manually check every script,
and the memory and time limits in php.ini (20s for exe, 30s for input and
8MB for mem) don't seem effective here. What are my options to make Apache 2
and PHP 5 full proof against such scripts?

Kind Regards,
Sander Holthaus

[Back to original message]