Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:89928 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 45103 invoked from network); 30 Dec 2015 22:14:06 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 30 Dec 2015 22:14:06 -0000 Authentication-Results: pb1.pair.com smtp.mail=bobwei9@hotmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=bobwei9@hotmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain hotmail.com designates 65.55.111.111 as permitted sender) X-PHP-List-Original-Sender: bobwei9@hotmail.com X-Host-Fingerprint: 65.55.111.111 blu004-omc2s36.hotmail.com Received: from [65.55.111.111] ([65.55.111.111:50938] helo=BLU004-OMC2S36.hotmail.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id C8/16-51216-D2754865 for ; Wed, 30 Dec 2015 17:14:05 -0500 Received: from BLU436-SMTP242 ([65.55.111.72]) by BLU004-OMC2S36.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Wed, 30 Dec 2015 14:14:02 -0800 X-TMN: [SuA2UDvOWR5midwrvuRutL/CWxZsBRBJ] X-Originating-Email: [bobwei9@hotmail.com] Message-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Wed, 30 Dec 2015 23:13:57 +0100 CC: Nikita Popov To: PHP internals MIME-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) X-Mailer: Apple Mail (2.3096.5) X-OriginalArrivalTime: 30 Dec 2015 22:14:00.0213 (UTC) FILETIME=[625C0450:01D1434F] Subject: Better HashDos protection From: bobwei9@hotmail.com (Bob Weinand) Hey, some time ago we had a discussion about HashDos protection initiated by = Nikita. There just was one major flaw that it still allowed to crash = (fatal error) background processes with no chance to intercept these. Hence, an exception is thrown instead in array functions respectively = (parse_str and json_decode) the function is properly failed. There still is a path reaching the fatal error, but it should never be = reached under normal operation via external input, and if it does, then = it should be fixed too. The pull request is found at https://github.com/php/php-src/pull/1706 This hopefully should eliminate this DoS vector completely. Bob=