I am trying to follow the test script provided here. I've installed an apache web server with PHP version 5.3.25 and created a script with the following code:

// file: test.php
$str = quoted_printable_encode(str_repeat("\xf4", 1000));
echo "$str";

I pointed my browser to "localhost/test.php" and I get a thousand '=F4's, but nothing indicates that PHP crashed or produced a segfault. I've increased the number to 1,000,000 but nothing changed, aside from the number of '=F4's. Has anyone else ever reproduced this or know of any resources with more info besides the page I've linked? I've been scouring Google for more information for weeks, but I only get bug report pages. Thanks.

  • What OS are you using? The bug reports do not indicate a lot of details, so it is hard to say what all the conditions are to trigger this crash. – schroeder Apr 21 '15 at 17:47
  • I'm using Debian 3.2.65. – lche Apr 21 '15 at 17:52
  • Apple and Ubuntu post bugs about this CVE, too. You could try on another OS to confirm. – schroeder Apr 21 '15 at 17:53

Browse other questions tagged or ask your own question.