Question

I do not find anything on the web and I don’t know why: Calling

filter_var($address, FILTER_VALIDATE_EMAIL)

leads to the connection being reset (at least that’s what Firefox tells me). The server has PHP version 5.3.13 with Suhosin-Patch on FreeBSD.
Testing this on my own server which runs Debian and PHP version 5.3.3 also with Suhosin works fine, though I seem to remember it did show the same behaviour before.

PHP manual indicates this was introduced on PHP 5.2.0 so it should work, shouldn’t it?

Edit: To better show what fails, I show you two examples, one with reset, the other with a proper die("message");

This example outputs Before validate on the browser Window:

if (function_exists('filter_var')) { //Introduced in PHP 5.2

    die("Before validate");
  if(filter_var($address, FILTER_VALIDATE_EMAIL) === FALSE) {
    return false;
  } else {
    return true;
  }
} else {
return preg_match('/^(?:[\w\!\#\$\%\&\'\*\+\-\/\=\?\^\`\{\|\}\~]+\.)*[\w\!\#\$\%\&\'\*\+\-\/\=\?\^\`\{\|\}\~]+@(?:(?:(?:[a-zA-Z0-9_](?:[a-zA-Z0-9_\-](?!\.)){0,61}[a-zA-Z0-9_-]?\.)+[a-zA-Z0-9_](?:[a-zA-Z0-9_\-](?!$)){0,61}[a-zA-Z0-9_]?)|(?:\[(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\]))$/', $address);
}

The example leads to the aforementioned “connection was reset…”:

if (function_exists('filter_var')) { //Introduced in PHP 5.2


  if(filter_var($address, FILTER_VALIDATE_EMAIL) === FALSE) {

  die("After validate");
    return false;
  } else {

  die("After validate");
    return true;
  }
} else {
  return preg_match('/^(?:[\w\!\#\$\%\&\'\*\+\-\/\=\?\^\`\{\|\}\~]+\.)*[\w\!\#\$\%\&\'\*\+\-\/\=\?\^\`\{\|\}\~]+@(?:(?:(?:[a-zA-Z0-9_](?:[a-zA-Z0-9_\-](?!\.)){0,61}[a-zA-Z0-9_-]?\.)+[a-zA-Z0-9_](?:[a-zA-Z0-9_\-](?!$)){0,61}[a-zA-Z0-9_]?)|(?:\[(?:(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d{1,2}|2[0-4]\d|25[0-5])\]))$/', $address);
}

I do not get an output like “After validate” here.
Also the address is a very easy “[e-mail]” address, so its even valid.

Okay another edit: I made a oneliner running only this function and executed it on the console. This is the output:

/libexec/ld-elf.so.1: /usr/local/lib/php/20090626/filter.so: Undefined symbol "php_pcre_exec"

I handed this over to the server admin. From what I found on google, a simple update could solve it, but I will have to wait for his answer. If the issue is solved, I will note this here. Until then this will have to rest, as I cannot fix such a system-deep error.

Answer 1

in this suhosin summary they talk about a fix to a segfault when using that flag, it’s an opensuse report but it might be that your install is susceptible to it. You’ll probably need to make sure that your suhosin patch is up to at least what corresponds to opensuse’s version 0.17.1. Problem is I can’t find anything about it on suhosin’s official changelog. Where does freebsd get their port source from in this case?

• Tue Oct 26 2010 [e-mail]
  • fix “Segfault in filter_var with FILTER_VALIDATE_EMAIL with
    large amount of data” [bnc#649210]
  • CVE-2010-3710.patch