Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96093
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.175 as permitted sender)
To: internals@lists.php.net
References: <CAKws9z2EWkNNhM7tOMh-_pQ3iLjVj7hbXTB1Hh3a19utPzj-9A@mail.gmail.com>
 <7d5727ba-da33-e3c5-1d1f-318c45d81616@cubiclesoft.com>
 <CAKws9z38_QhH8rnshJu=SP1Aav7jhMnVR2H992+Lse7iMeQ3oA@mail.gmail.com>
 <ffc669b5-8764-3879-0c5a-d047d75c9b45@gmail.com>
 <CAGa2bXYad=5CNKUR4GTR-uB8L1Gb-2CJk5Fiperz5D_CTL+rxw@mail.gmail.com>
 <9522ebc9-8d8b-045e-b701-02f1166063e6@gmail.com>
 <CAGa2bXYNZwKrT=Ei8r1DghGjqOGiMUVPEGY31wYK9Hpt+C9XMQ@mail.gmail.com>
 <CANUQDCjcnFdPyG133z6g0DdRLZjUG=+BRhcv4Es9Z+WeoU-Prg@mail.gmail.com>
 <CAFGtT7Zd3+iRuaJtwpML3hO6Kbdu7YtnNOE14zvA78E=QiNprg@mail.gmail.com>
 <40868951-8BDA-4860-884C-B8252C1839E3@gmail.com>
 <d2080444-9a17-b3db-89fa-c383155a5756@thefsb.org>
 <CAF+90c-uFg9A2f1SVYTNgjQuFX5PkenrtXd8kf37cYoG0EfgEw@mail.gmail.com>
 <edeb9734-a3d4-bd96-f57c-fa1687473e1b@gmail.com>
 <CAF+90c9HTpxtY8zeKoOfjdQXTkrVQSw8fb9Ws0-Qs_xmJtttZw@mail.gmail.com>
 <9ce33625-2737-9933-7dd1-4f7930bccfac@gmail.com>
 <CAEKnhAGg829gi7uEBimZqdd-cTvAn4a1HmjDfEoYeLO93_L2wQ@mail.gmail.com>
Message-ID: <9b0fcfa7-f4f8-bac3-5e1e-7e974f217a94@gmail.com>
Date: Thu, 22 Sep 2016 10:06:16 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAEKnhAGg829gi7uEBimZqdd-cTvAn4a1HmjDfEoYeLO93_L2wQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] HashDoS
From: rowan.collins@gmail.com (Rowan Collins)

On 22/09/2016 08:52, Jakub Zelenka wrote:
> I don't like the initial version of the patch that was causing fatal error
> for json_decode. That's not how json_decode should work. I think that Bob
> came up later with a better version that was using json recursion error. It
> might require a bit more work for 7.1 as I changed a json parser since then.

The point of the proposed patch is that it causes fatal error *anywhere* 
that a hash is attacked (and, as discussed, it really is only going to 
trigger on a crafted attack).

Adding mitigations elsewhere such as in the JSON parser can be done *on 
top of* that, since they'll presumably catch the problem before the hash 
is inserted into.

It's the same as if the attack caused an exponential amount of memory 
usage: the engine will bail out as soon as the hard memory limit is 
reached, but extensions can and should detect and avoid scenarios likely 
to cause that.

Regards,
-- 
Rowan Collins
[IMSoP]