Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57322
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.170 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <CABBJUpeWophF3Z9wU66L6qNdQRxC0H3_eHF8Y+OoN42ub0=THQ@mail.gmail.com>
References: <CAEZPtU44aag3z-oGAx+mF1dvr9qF0ZLpdW3pHFWEe0uwbchMBQ@mail.gmail.com>
 <6268389813742875794@unknownmsgid> <CAEZPtU6bSu0yVcBTKw7SXM29cNb_=b_kthpKr4B-z3ArreXyhQ@mail.gmail.com>
 <CABBJUpeWophF3Z9wU66L6qNdQRxC0H3_eHF8Y+OoN42ub0=THQ@mail.gmail.com>
Date: Tue, 10 Jan 2012 11:06:50 +0100
Message-ID: <CAMUwpuT6XnoXS_4yFq8c73p0+0_d=VSD-qEmHguUke6JAj+LZA@mail.gmail.com>
To: Xinchen Hui <laruence@gmail.com>
Cc: Pierre Joye <pierre.php@gmail.com>, PHP internals <internals@lists.php.net>, 
	=?ISO-8859-1?Q?Johannes_Schl=FCter?= <johannes@schlueters.de>
Content-Type: multipart/alternative; boundary=00151748e70cf8ebb104b629aead
Subject: Re: [PHP-DEV] Re: 5.3.9, Hash DoS, release
From: jpauli@php.net (jpauli)

--00151748e70cf8ebb104b629aead
Content-Type: text/plain; charset=GB2312
Content-Transfer-Encoding: quoted-printable

2012/1/10 Xinchen Hui <laruence@gmail.com>

> On Tue, Jan 10, 2012 at 12:57 AM, Pierre Joye <pierre.php@gmail.com>
> wrote:
> > hi,
> >
> > No time for new ideas yet. We cannot afford to implement, test and
> > valid new propositions and provide a fix as soon as possible (read: in
> > the next days).
> >
> > What's the status of your patch? The max input var one, not the random
> > (or derived version), can you post it in this thread again for the
> > record please?
> Hi, FYI
>
> thanks
> >
> > If not, we will go final with the current fix in 5.3.
> >
> > On Mon, Jan 9, 2012 at 5:36 PM, Xinchen Hui <laruence@gmail.com> wrote:
> >> Hi:
> >>   I have a new idea, which is simple and also works for
> Jason/serialized etc.
> >>
> >>  That is Restricting a max length of a buckets list in a hash table.
> >>
> >>   If a bucket's length exceed 1024, any insertion into this bucket
> >> will return failure and a warning will be generated.
> >>
> >>   What do you think?
> >>
> >> Sent from my iPhone
> >>
> >> =D4=DA 2012-1-9=A3=AC23:42=A3=ACPierre Joye <pierre.php@gmail.com> =D0=
=B4=B5=C0=A3=BA
> >>
> >>> hi,
> >>>
> >>> Moving this discussion here as it makes little to non sense to discus=
s
> >>> that any longer on security@
> >>>
> >>> We are now very late behind an acceptable delay to provide a fix for
> >>> the hash DoS, to say it nicely.
> >>>
> >>> I'd strongly suggest to release 5.3.9 (RC5 has been tested now) final
> >>> this week using the max_input_vars fix, with the modification from
> >>> Laruence (but with a larger limit). Laruence addition also fixes
> >>> serialize or json, which are parts that need this fix as well as it i=
s
> >>> impossible to valid a string manually (length check only is not enoug=
h
> >>> or cannot work in all cases).
> >>>
> >>> But 1st of all, the fix addition has to be applied and fully tested.
> >>> But if the addition is not desired yet, then we must at least release
> >>> 5.3.9 with Dmitry's fix only and we can fix json&serialize later,
> >>> ideally within 2 weeks max.
> >>>
> >>> Cheers,
> >>> --
> >>> Pierre
> >>>
> >>> @pierrejoye | http://blog.thepimp.net | http://www.libgd.org
> >
> >
> >
> > --
> > Pierre
> >
> > @pierrejoye | http://blog.thepimp.net | http://www.libgd.org
>
>
>
> --
> =BB=DD=D0=C2=E5=B7        laruence
> Senior PHP Engineer
> http://www.laruence.com
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

Why not double hashing (http://en.wikipedia.org/wiki/Double_hashing)
somelike John Crenshaw proposed ?

Julien

--00151748e70cf8ebb104b629aead--