Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57233
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.42 as permitted sender)
MIME-Version: 1.0
Sender: laruence@gmail.com
Date: Thu, 5 Jan 2012 16:53:45 +0800
Message-ID: <CABBJUpe+BqyoUXbo=jN_V8N3RFrWt9gCA1s0LCztP0RFKD2+JA@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Cc: Rasmus Lerdorf <rasmus@lerdorf.com>, Stas Malyshev <smalyshev@sugarcrm.com>, 
	Pierre Joye <pierre.php@gmail.com>, =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>, 
	Dmitry Stogov <dmitry@php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Yet another fix for max_input_vars
From: laruence@php.net (Laruence)

Hi:
    the origin thread is too long, so I open a new thread for this.

    I have made another patch try to fix this issue.

    the key point is, randomizing the table size(tableMask).

    instead of double the the table size in zend_hash_do_resize,  I
increase the table size with a random delta ( the value now is just a
try,  we can change it to a more appropriate value),
 that is:  new_table_size =3D old_table_size * 2 + random_num.

    then,  the collision can not be predicatible, which fix the
problem,  and also fixed the issue in json/soap/serialize etc.

    here is the patch(draft now):
https://bugs.php.net/patch-display.php?bug_id=3D60655&patch=3Drand_hash_res=
ize.patch&revision=3Dlatest

    after this fix , may slow down the php, but compared to the
security threat I thinks the cost could be ignored.

    for the test script list in
http://nikic.github.com/2011/12/28/Supercolliding-a-PHP-array.html:

    *before patched:
        Inserting 65536 evil elements took 162.65940284729 seconds
        Inserting 65536 good elements took 0.075557947158813 seconds

    *after  patched:
        Inserting 65536 evil elements took 0.074128866195679 seconds
        Inserting 65536 good elements took 0.091044902801514 seconds

    what do you think ?

thanks

--=20
Laruence =C2=A0Xinchen Hui
http://www.laruence.com/