Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57302
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <6268389813742875794@unknownmsgid>
References: <CAEZPtU44aag3z-oGAx+mF1dvr9qF0ZLpdW3pHFWEe0uwbchMBQ@mail.gmail.com>
	<6268389813742875794@unknownmsgid>
Date: Mon, 9 Jan 2012 17:57:34 +0100
Message-ID: <CAEZPtU6bSu0yVcBTKw7SXM29cNb_=b_kthpKr4B-z3ArreXyhQ@mail.gmail.com>
To: Xinchen Hui <laruence@gmail.com>
Cc: PHP internals <internals@lists.php.net>, =?ISO-8859-1?Q?Johannes_Schl=FCter?= <johannes@schlueters.de>, 
	Laruence <laruence@php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: 5.3.9, Hash DoS, release
From: pierre.php@gmail.com (Pierre Joye)

hi,

No time for new ideas yet. We cannot afford to implement, test and
valid new propositions and provide a fix as soon as possible (read: in
the next days).

What's the status of your patch? The max input var one, not the random
(or derived version), can you post it in this thread again for the
record please?

If not, we will go final with the current fix in 5.3.

On Mon, Jan 9, 2012 at 5:36 PM, Xinchen Hui <laruence@gmail.com> wrote:
> Hi:
> =C2=A0 I have a new idea, which is simple and also works for Jason/serial=
ized etc.
>
> =C2=A0That is Restricting a max length of a buckets list in a hash table.
>
> =C2=A0 If a bucket's length exceed 1024, any insertion into this bucket
> will return failure and a warning will be generated.
>
> =C2=A0 What do you think?
>
> Sent from my iPhone
>
> =E5=9C=A8 2012-1-9=EF=BC=8C23:42=EF=BC=8CPierre Joye <pierre.php@gmail.co=
m> =E5=86=99=E9=81=93=EF=BC=9A
>
>> hi,
>>
>> Moving this discussion here as it makes little to non sense to discuss
>> that any longer on security@
>>
>> We are now very late behind an acceptable delay to provide a fix for
>> the hash DoS, to say it nicely.
>>
>> I'd strongly suggest to release 5.3.9 (RC5 has been tested now) final
>> this week using the max_input_vars fix, with the modification from
>> Laruence (but with a larger limit). Laruence addition also fixes
>> serialize or json, which are parts that need this fix as well as it is
>> impossible to valid a string manually (length check only is not enough
>> or cannot work in all cases).
>>
>> But 1st of all, the fix addition has to be applied and fully tested.
>> But if the addition is not desired yet, then we must at least release
>> 5.3.9 with Dmitry's fix only and we can fix json&serialize later,
>> ideally within 2 weeks max.
>>
>> Cheers,
>> --
>> Pierre
>>
>> @pierrejoye | http://blog.thepimp.net | http://www.libgd.org



--=20
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org