[PHP-BUG] Bug #78845 [NEW]: Serious bug with latest PHP 7.2.24 bug

[email protected] ("gilperon at gmail dot com") Wed, 20 Nov 2019 22:36:29 +0000
Newsgroups php.standards
Message-ID <[email protected]>
From:             gilperon at gmail dot com
Operating system: Centos 7
PHP version:      7.2.24
Package:          PHP Language Specification
Bug Type:         Bug
Bug description:Serious bug with latest PHP 7.2.24 bug

Description:
------------
Hi,

I have found a very serious and easy to reproduce bug happening with
CURL on latest PHP 7.2.X (which is 7.2.24).

Just run the code below on your server running PHP+APACHE+MARIADB:

<?php

$curl = curl_init();

$opts = array();

$opts[CURLOPT_URL] = "https://www.sitepor500.com.br";

curl_setopt_array($curl,$opts);

echo curl_exec($curl);

?>

It will work just fine, I mean, you will see the contents of the page on
CURLOPT_URL. Now JUST ADD one single line of code to it and the bug will
happen:

<?php

$conn = mysqli_connect("localhost","root","your_password");

$curl = curl_init();

$opts = array();

$opts[CURLOPT_URL] = "https://www.sitepor500.com.br";

curl_setopt_array($curl,$opts);

echo curl_exec($curl);

?>

Incredibly, just adding a connection to a local database will make CURL
fetch the content of the URL specified at CURLOPT_URL as "" (empty
string). This happens with any URL.

Test script:
---------------
<?php

$conn = mysqli_connect("localhost","root","your_password");

$curl = curl_init();

$opts = array();

$opts[CURLOPT_URL] = "https://www.sitepor500.com.br";

curl_setopt_array($curl,$opts);

echo curl_exec($curl);

?>

Expected result:
----------------
You should see the URL content

Actual result:
--------------
Nothing is shown

-- 
Edit bug report at https://bugs.php.net/bug.php?id=78845&edit=1
-- 
Fix committed:                    https://bugs.php.net/fix.php?id=78845&r=fixed
Fixed in release:                 https://bugs.php.net/fix.php?id=78845&r=alreadyfixed
Need backtrace:                   https://bugs.php.net/fix.php?id=78845&r=needtrace
Need Reproduce Script:            https://bugs.php.net/fix.php?id=78845&r=needscript
Try newer version:                https://bugs.php.net/fix.php?id=78845&r=oldversion
Not developer issue:              https://bugs.php.net/fix.php?id=78845&r=support
Expected behavior:                https://bugs.php.net/fix.php?id=78845&r=notwrong
Not enough info:                  https://bugs.php.net/fix.php?id=78845&r=notenoughinfo
Submitted twice:                  https://bugs.php.net/fix.php?id=78845&r=submittedtwice
register_globals:                 https://bugs.php.net/fix.php?id=78845&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=78845&r=phptooold
Daylight Savings:                 https://bugs.php.net/fix.php?id=78845&r=dst
IIS Stability:                    https://bugs.php.net/fix.php?id=78845&r=isapi
Install GNU Sed:                  https://bugs.php.net/fix.php?id=78845&r=gnused
Floating point limitations:       https://bugs.php.net/fix.php?id=78845&r=float
No Zend Extensions:               https://bugs.php.net/fix.php?id=78845&r=nozend
MySQL Configuration Error:        https://bugs.php.net/fix.php?id=78845&r=mysqlcfg