Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57298
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <ACB36599-E7B4-45F8-889A-223F945D5444@nopiracy.de>
References: <CAEZPtU44aag3z-oGAx+mF1dvr9qF0ZLpdW3pHFWEe0uwbchMBQ@mail.gmail.com>
	<CAF+90c8ajB0RUnEGHxo-sjYh+YZCkqaXGE7e-3YX11PCvSZ+uw@mail.gmail.com>
	<ACB36599-E7B4-45F8-889A-223F945D5444@nopiracy.de>
Date: Mon, 9 Jan 2012 17:48:31 +0100
Message-ID: <CAEZPtU4pL+xToXyEOe6K+CD9ZqgJ+bk_tSHr73a6GVsknhqJbQ@mail.gmail.com>
To: Stefan Esser <stefan@nopiracy.de>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] 5.3.9, Hash DoS, release
From: pierre.php@gmail.com (Pierre Joye)

On Mon, Jan 9, 2012 at 5:18 PM, Stefan Esser <stefan@nopiracy.de> wrote:
> Dear Pierre and others,
>
>> I'd strongly suggest to release 5.3.9 (RC5 has been tested now) final
>> this week using the max_input_vars fix, with the modification from
>> Laruence (but with a larger limit). Laruence addition also fixes
>> serialize or json, which are parts that need this fix as well as it is
>> impossible to valid a string manually (length check only is not enough
>> or cannot work in all cases).
>
> Why do you advocate a patch from Laruence that randomizes the size of the HashTable, which does not fix the HashDOS security problem at all?

I do not, I refer to his other patch which does exactly what Dmitry's
one does and uses the same limit for json and serialize.

I'm actually against the randomize version of the fix as we have not
yet enough clue about how good (or bad) it is.

Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org