Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57669
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <0C9EDEF9-3E36-4C33-B566-6191EDD90568@nopiracy.de>
References: <CALjhHG_wYvJn-Z+x9fJUi+dgmZ+Ha9BD54N5VwhneJM4sg1xBQ@mail.gmail.com>
 <5FB5CFDA-6FE8-4C20-A9B9-7844ED96659B@nopiracy.de> <CAEZPtU7jtQTDNpUovxxnDdRunjH9BOdX=WbS8JcGz+5Wkz8ocw@mail.gmail.com>
 <46104CB6-A868-41C3-B8E1-F1E0AC06BCAB@nopiracy.de> <CAEZPtU4oqvSmjU=3Oh3iuRtw5MZLaGTPLWFu-KTtq_ScKsu4Vw@mail.gmail.com>
 <A53679E3-53ED-423C-AC4C-E9C4A8631C20@nopiracy.de> <alpine.DEB.2.02.1202021628341.20012@whisky.home.derickrethans.nl>
 <0C9EDEF9-3E36-4C33-B566-6191EDD90568@nopiracy.de>
Date: Sat, 4 Feb 2012 07:19:45 +0900
Message-ID: <CAGa2bXYmo7u8pTRt9rE1wr+_Jou0oBXNdQwsukFnmOhDsJn7ww@mail.gmail.com>
To: Stefan Esser <stefan@nopiracy.de>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Suhosin patch disabled by default in Debian php5 builds
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

>>> http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=317225&r2=318997
>>
>> I'm sure we'd be more than happy to hear why it's broken and hear about
>> possible suggested fixes.
>
> The purpose of the code is to detect all occurences of \r or \n not followed by whitespace and error out.
> It is obviously doing something else.

Just looking at the patch. The comment in the code states

/* new line safety check */

but it cannot be a safety check as Stefan mentioned.
It should be fixed, if it was intended as security measure.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net



2012/2/3 Stefan Esser <stefan@nopiracy.de>:
> Hello Derick,
>
>>> * and most probably many more that I do not know from the top of my
>>> head (this are already 9 features and Suhosin/HPHP exists since 2004 =
>>> 8 years).
>>
>> Lots of stuff in PHP was also "stolen" from Xdebug, but I am not whining
>> about that as the goal is (and has always been) to make PHP better.
>
> I am not whining of something being stolen I trying to demonstrate that a lot of the features noone ever saw a need for in PHP have been cloned.
> PHP devs repeatedly tell that Suhosin brings no additional value, while they clone and clone every time they are hit by a nasty bug.
>
>
>>> http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/SAPI.c?r1=317225&r2=318997
>>
>> I'm sure we'd be more than happy to hear why it's broken and hear about
>> possible suggested fixes.
>
> The purpose of the code is to detect all occurences of \r or \n not followed by whitespace and error out.
> It is obviously doing something else.
>
> Regards,
> Stefan
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>