Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71573
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXb7iVGbqpQh8TkDDyr-FmCWTFg1rcXj23ScErhNmikbNw@mail.gmail.com>
References: <CAGa2bXb7iVGbqpQh8TkDDyr-FmCWTFg1rcXj23ScErhNmikbNw@mail.gmail.com>
Date: Sun, 26 Jan 2014 01:38:17 +0100
Message-ID: <CAF+90c91stw8B8xqzcg7mfjYWjwRRO71PsHkiFMBjWpGdb6N3g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c1d6a8a430b404f0d4ce0b
Subject: Re: [PHP-DEV] [VOTE] RFC: Multibyte Char Handling
From: nikita.ppv@gmail.com (Nikita Popov)

--001a11c1d6a8a430b404f0d4ce0b
Content-Type: text/plain; charset=ISO-8859-1

On Sun, Jan 26, 2014 at 1:23 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> This RFC is to fix CVE-2014-1239.
>
> https://wiki.php.net/rfc/multibyte_char_handling
>
> Adding required functions to mbstring and provide them
> from PHP 5.3 and up and replacing mbstring to mbstring-ng
> for future releases.
>
> Thank you for voting!
>

This RFC conflates the addition of a multibyte version of addslashes (in
response to quoted CVE) with the replacement of the mbstring extension by a
completely different implementation (and an incomplete one at that). Those
two things have very little to do with each other and should not be covered
in the same RFC and/or vote.

Nikita

--001a11c1d6a8a430b404f0d4ce0b--