Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57304
Return-Path: <stefan@nopiracy.de>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 65833 invoked from network); 9 Jan 2012 17:03:21 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 9 Jan 2012 17:03:21 -0000
Authentication-Results: pb1.pair.com header.from=stefan@nopiracy.de; sender-id=unknown
Authentication-Results: pb1.pair.com smtp.mail=stefan@nopiracy.de; spf=permerror; sender-id=unknown
Received-SPF: error (pb1.pair.com: domain nopiracy.de from 81.169.146.162 cause and error)
X-PHP-List-Original-Sender: stefan@nopiracy.de
X-Host-Fingerprint: 81.169.146.162 mo-p00-ob.rzone.de Solaris 10 (beta)
Received: from [81.169.146.162] ([81.169.146.162:37077] helo=mo-p00-ob.rzone.de)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 73/64-46289-7DD1B0F4 for <internals@lists.php.net>; Mon, 09 Jan 2012 12:03:21 -0500
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; t=1326128592; l=502;
	s=domk; d=nopiracy.de;
	h=To:References:Content-Transfer-Encoding:Cc:Date:In-Reply-To:From:
	Content-Type:Mime-Version:Subject:X-RZG-CLASS-ID:X-RZG-AUTH;
	bh=fSvcCAbqq+J8NjIv4PSIsLx/pfw=;
	b=VQKer0su72JFw67Pv/zLTHXqt0X/w+ZxDGgofvFRxt/Qvo7i9jul2SLvFxzItX/Qfty
	2FQTBDy16zV0m6jwdoy4RwF02lJN1RJ8h1nh5wuy+ZlPVBL1yKjhFGdHT3t2lYHW99YTa
	Es1eXsE0QhSHwGM+XR2Ba/nNec4JeTyvr7g=
X-RZG-AUTH: :OH4FY0Wkd/plSHgwfKFIgHoVYx5SSathkA9OvI+ii+JXGfvQUzm/Ahii7iullNGyVg==
X-RZG-CLASS-ID: mo00
Received: from [10.23.17.42] (cable-78-34-71-151.netcologne.de [78.34.71.151])
	by post.strato.de (mrclete mo62) (RZmta 27.3 DYNA|AUTH)
	with (AES128-SHA encrypted) ESMTPA id v0291do09EpqnJ ;
	Mon, 9 Jan 2012 18:03:08 +0100 (MET)
Mime-Version: 1.0 (Apple Message framework v1251.1)
Content-Type: text/plain; charset=iso-8859-1
In-Reply-To: <CAEZPtU7Efu4R5i72cv1hsvM0rL2QJP=Gz_aWYw6jBe14E7HSBA@mail.gmail.com>
Date: Mon, 9 Jan 2012 18:03:08 +0100
Cc: Nikita Popov <nikita.ppv@googlemail.com>,
 PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <68FB555B-EFE9-4879-AAFC-AC92B4018E77@nopiracy.de>
References: <CAEZPtU44aag3z-oGAx+mF1dvr9qF0ZLpdW3pHFWEe0uwbchMBQ@mail.gmail.com> <CAF+90c8ajB0RUnEGHxo-sjYh+YZCkqaXGE7e-3YX11PCvSZ+uw@mail.gmail.com> <F6CEA653-DD25-4461-A963-99B0DCD0EB24@nopiracy.de> <CAF+90c-VWaMG=SETzzYnAhyu_EMTpFsgZ9-ti40GCcL0fZ+XSg@mail.gmail.com> <69E4BB23-9F97-449F-A44A-8731B0D5141E@nopiracy.de> <CAEZPtU7Efu4R5i72cv1hsvM0rL2QJP=Gz_aWYw6jBe14E7HSBA@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
X-Mailer: Apple Mail (2.1251.1)
Subject: Re: [PHP-DEV] 5.3.9, Hash DoS, release
From: stefan@nopiracy.de (Stefan Esser)

Hello Pierre,

> Not really the same, but yes. While the reasons you did it was not the
> same. Also the length check is not related or cannot be used for this
> fix. But nice self promotion ;-)

Considering the fact that the HashDOS problem was originally discussed =
in a paper 2003, someone discussed HashDOS vs. PHP originally somewhen =
in 2004 and Hardened-PHP came out in 2004 it is funny that you believe =
to know, why I added variable count restrictions.

Regards,
Stefan Esser=