Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89510
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CA+9eiLsK-eY-w7j21zjFQUsYbNCih3o6kOW5wmcq9G0QxajWeQ@mail.gmail.com>
References: <CAF+90c_pVFVbzqThuPg1V3VDTV-7Ci4O6T6hNtY5XPgVb2Mt-Q@mail.gmail.com>
	<CA+9eiLsK-eY-w7j21zjFQUsYbNCih3o6kOW5wmcq9G0QxajWeQ@mail.gmail.com>
Date: Tue, 1 Dec 2015 12:08:50 +0000
Message-ID: <CABHuAWxBLXJFGoPZwS2z67gW94f5U4FQ7svwAStBkn5wwXrnvA@mail.gmail.com>
To: Dmitry Stogov <dmitry@zend.com>
Cc: Nikita Popov <nikita.ppv@gmail.com>, PHP internals <internals@lists.php.net>, 
	Anatol Belski <anatol.php@belski.net>, Remi Collet <remi@php.net>
Content-Type: multipart/alternative; boundary=047d7ba97e644ba1a30525d50522
Subject: Re: [PHP-DEV] HashDos protection
From: t.carnage@gmail.com (Chris Riley)

--047d7ba97e644ba1a30525d50522
Content-Type: text/plain; charset=UTF-8

On 1 December 2015 at 09:50, Dmitry Stogov <dmitry@zend.com> wrote:

> Hi Nikita,
>
> few notes:
>
> It looks like the patch messes the attempt of catching the problem (few
> lines related to zend_hash_find_bucket changes) with optimization to
> compensate collision check overhead (everything else). I think it's better
> to separate these parts.
>
> Introduction of zend_hash_add_or_return() in 7.0.1 is going to make forward
> incompatibility with 7.0.0. However, we may reserve it for internal usage
> removing ZEND_API.
>
> I don't think PHP should prevent user from construction of arrays he likes,
> because of internal problems (like in your example).
>
> >  $s = 1 << 16; $a = [];
> >  for ($i = 0; count($a) < $s; $i += $s) { $a[$i] = 0; }
>
> It makes performance problem, but it doesn't mean we should kill it.
> We have "max_execution_time" to catch them all.
>
> I think only big arrays coming from external sources should be checked.
>
> Your solution is incomplete, anyway, because of crafting a single list with
> 10000 collisions, attacker will able to use N lists with 1000 collisions.
>
> Thanks. Dmitry.


This is a good point but bear in mind to get the same effect as for 10000
collisions, you'd need 100 lists not 10

--047d7ba97e644ba1a30525d50522--