Last modified: 2011-09-14 23:59:27 UTC

Wikimedia Bugzilla is closed!

Wikimedia has migrated from Bugzilla to Phabricator. Bug reports should be created and updated in Wikimedia Phabricator instead. Please create an account in Phabricator and add your Bugzilla email address to it.
Wikimedia Bugzilla is read-only. If you try to edit or create any bug report in Bugzilla you will be shown an intentional error message.
In order to access the Phabricator task corresponding to a Bugzilla report, just remove "static-" from its URL.
You could still run searches in Bugzilla or access your list of votes but bug reports will obviously not be up-to-date in Bugzilla.
Bug 14898 - Excessively large offset specified in {{#time:}} causes timeout
Excessively large offset specified in {{#time:}} causes timeout
Status: RESOLVED FIXED
Product: MediaWiki extensions
Classification: Unclassified
ParserFunctions (Other open bugs)
unspecified
All All
: High major with 1 vote (vote)
: ---
Assigned To: Tim Starling
: upstream
: 28127 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-23 16:05 UTC by Ed de Jonge
Modified: 2011-09-14 23:59 UTC (History)
7 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments
Patch for PHP 5.x (4.53 KB, patch)
2008-09-13 12:56 UTC, Tim Starling
Details

Description Ed de Jonge 2008-07-23 16:05:38 UTC
In markup, {{#time: <mask> | <large_integer> <unit>}} where <large_integer> is de magnitude of 1E12 , when using the Preview button, the server returns the error page saying 
"Wikimedia Foundation - Error - Our servers are currently experiencing a technical problem ..." after 1 minute.
Example: {{#time:j F| +1000000000000 days}}
Expected result: immediate "Error: invalid time"
(No attempt to save the page was made for security reason.)

However, moderately large numbers, like 1E11 cause long delays, but successfully return "Error: invalid time" .
Comment 1 Fran Rogers 2008-08-20 05:43:23 UTC
This actually appears to be a bug in PHP's strtotime() function; a rather nasty one. Running this:

php -r "strtotime('+1000000000000 days');"

causes PHP to run seemingly forever on my laptop. Unfortunately, I'm not completely sure how we'd be able to detect this consistently.
Comment 2 Ed de Jonge 2008-08-20 10:31:32 UTC
If this implies potential DoS vulnerability, this report's severity and priority status may need updating.
Comment 3 Fran Rogers 2008-08-20 19:12:56 UTC
Indeed, this has DoS potential; I've upgraded it to "Critical."

This bug recently filed in PHP's bug tracker appears to be the cause:
http://bugs.php.net/bug.php?id=45822
Comment 4 Tim Starling 2008-09-13 12:56:48 UTC
Created attachment 5329 [details]
Patch for PHP 5.x

I've sent this patch to Derick Rethans, who maintains the code in question, but he hasn't applied it yet, AFAIK. I talked to him about it on IRC and didn't seem very interested. It doesn't work for PHP 6. PHP 6 has some extra features and I still need a bit of extra inspiration to reimplement them in a loop-free way.
Comment 5 Siebrand Mazeland 2008-11-02 21:47:01 UTC
Just did a quick feedback check with Derick. Response: no time, but not forgotten.
Comment 6 Tim Starling 2009-05-12 06:10:29 UTC
Derick tells me that a solution to this problem is in PHP 5.3-cvs.
Comment 7 Max Semenik 2010-05-29 12:43:02 UTC
Now that the crash problem is solved, PF should handle such cases sanely. Currently, for {{#time:j F| +1000000000000 days}} the output is "90 <>", which is a bit random.
Comment 8 Mark A. Hershberger 2011-03-19 03:05:56 UTC
Since the fix is in PHP, anyone running into this problem should run PHP 5.3+ (I trust Tim to reopen if I'm wrong.)
Comment 9 Brion Vibber 2011-09-14 23:59:27 UTC
*** Bug 28127 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links