Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57301
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <6268389813742875794@unknownmsgid>
References: <CAEZPtU44aag3z-oGAx+mF1dvr9qF0ZLpdW3pHFWEe0uwbchMBQ@mail.gmail.com>
	<6268389813742875794@unknownmsgid>
Date: Mon, 9 Jan 2012 17:54:18 +0100
Message-ID: <CAF+90c9noBgpbPBB0UEygFwr4G=Sw=0VXJxeDsKCmVxzNESRWQ@mail.gmail.com>
To: Xinchen Hui <laruence@gmail.com>
Cc: Pierre Joye <pierre.php@gmail.com>, PHP internals <internals@lists.php.net>, 
	=?ISO-8859-1?Q?Johannes_Schl=FCter?= <johannes@schlueters.de>, 
	Laruence <laruence@php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: 5.3.9, Hash DoS, release
From: nikita.ppv@googlemail.com (Nikita Popov)

On Mon, Jan 9, 2012 at 5:36 PM, Xinchen Hui <laruence@gmail.com> wrote:
> Hi:
> =A0 I have a new idea, which is simple and also works for Jason/serialize=
d etc.
>
> =A0That is Restricting a max length of a buckets list in a hash table.
>
> =A0 If a bucket's length exceed 1024, any insertion into this bucket
> will return failure and a warning will be generated.
>
> =A0 What do you think?

That seems like a very good approach (until we have randomization). It
would fix the issue in a generic way so not all functions need to be
patched one by one. It also will not hurt legit uses of many POST
variables (or large serialized arrays).