Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89470
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.50 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
In-Reply-To: <CAF+90c_pVFVbzqThuPg1V3VDTV-7Ci4O6T6hNtY5XPgVb2Mt-Q@mail.gmail.com>
References: <CAF+90c_pVFVbzqThuPg1V3VDTV-7Ci4O6T6hNtY5XPgVb2Mt-Q@mail.gmail.com>
Date: Fri, 27 Nov 2015 18:55:28 +0000
Message-ID: <CAEKnhAGR4g2pAtoiwbfg77AnxbDGLyqX2m_PPXrGEPgPrE055g@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: PHP internals <internals@lists.php.net>, Anatol Belski <anatol.php@belski.net>, 
	Remi Collet <remi@php.net>
Content-Type: multipart/alternative; boundary=001a11425816223c7f05258a3ca9
Subject: Re: [PHP-DEV] HashDos protection
From: bukka@php.net (Jakub Zelenka)

--001a11425816223c7f05258a3ca9
Content-Type: text/plain; charset=UTF-8

Hi,

On Thu, Nov 26, 2015 at 5:24 PM, Nikita Popov <nikita.ppv@gmail.com> wrote:
>
>
> What are your thoughts on this?
>
>
First of all, thanks a lot for looking into it! That's great!

I think that it's all cool except the fact that json_decode would result in
fatal error.  I don't think that json_decode should kill the script in this
case. It's much better to return NULL and set a new JSON_ERROR_...

We could maybe add some EG var to silence it when using json_decode and set
it back when finished. In that case when the collision limit is exceeded it
would set another EG that could be checked in the json_parser.y as
UNEXPECTED  after each addition to the object or array. It's not probably
nicest solution and it would probably slow down slightly the json parser
but it could work and it's still better than fatal error IMHO.

What do you think?

Cheers

Jakub

--001a11425816223c7f05258a3ca9--