Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88017
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.177 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXa41Jsh4vfNF+r3Mj2mLqPjT-UcgNgGzQ2U-d6MhwoMNw@mail.gmail.com>
References: <55E610C1.1000203@gmail.com> <CAGa2bXa41Jsh4vfNF+r3Mj2mLqPjT-UcgNgGzQ2U-d6MhwoMNw@mail.gmail.com>
Date: Thu, 3 Sep 2015 10:20:33 +0900
Message-ID: <CAGa2bXZtigz0dPe67HQJQnfjfnSNbnXP6m9Ut80BtXwF-8FUnA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Heads up: merging security patches to 7
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

On Wed, Sep 2, 2015 at 7:17 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> There are many fixes regarding unserialize.
> We also had many fixes regarding type mismatches.
> I suppose many 3rd party modules have same issues.
>
> How about have a doc for secure PHP internal coding?

I'm writing the draft.

I see number of var_push_dtor() to fix unserialization.
var_push_dtor() or var_push_dtor_no_addref() is required always when
php_var_unserialize() is failed.
Am I correct?

It will cover
 - Pointers to general secure programming resources
 - Basic memory management and debugging (how to use run-tests.php)
 - Unserialization
 - Type confusion
 - Typical overflows

If there is anything to add, please let me know.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net