Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104659
To: Stanislav Malyshev <smalyshev@gmail.com>,
 PHP internals <internals@lists.php.net>
References: <46354329-38ca-82a2-352d-71394e0ce6bd@gmx.de>
 <cbc070d0-fd1c-ceef-cea8-a4551bf7aa10@gmail.com>
Cc: Joe Watkins <krakjoe@php.net>
Message-ID: <ae4bc689-e5d2-86f6-fe7d-feb678349d6e@gmx.de>
Date: Mon, 11 Mar 2019 17:35:23 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.3
MIME-Version: 1.0
In-Reply-To: <cbc070d0-fd1c-ceef-cea8-a4551bf7aa10@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 7bit
Subject: =?UTF-8?Q?Re=3a_=5bPHP-DEV=5d_Mitigate_=e2=80=9cMagellan_vulnerabil?=
 =?UTF-8?B?aXRpdGVz4oCdIGluIFBIUCA3LjI/?=
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 19.02.2019 at 02:16, Stanislav Malyshev wrote:

>> In my opinion, adding this ini setting to PHP-7.4 is a no brainer, but I
>> suggest that we backport it to PHP-7.2 as well.
> 
> I don't see a reason why not - if the option is useful for improving
> security/stability, let's backport it. If it's security related, maybe
> even to 7.1 since it's still in security support (if it's not too hard).

I have applied the PR[1] to PHP-7.2+.  Joe may consider to cherry-pick
to 7.1.

[1] <https://github.com/php/php-src/pull/3709>

-- 
Christoph M. Becker