Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96637
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH7O2SoBcfzYdAupTYTWVpuiQWriSMaJi7nWMUbSDzU9oQ@mail.gmail.com>
References: <1ae4bea0-d62b-fd61-f6b6-55762e97df6e@gmail.com>
 <573da963-6121-3231-b603-4c5d6b332c9d@fedoraproject.org> <CAH-PCH7O2SoBcfzYdAupTYTWVpuiQWriSMaJi7nWMUbSDzU9oQ@mail.gmail.com>
Date: Sat, 29 Oct 2016 17:11:03 +0700
Message-ID: <CAEZPtU4=7evKpd=CxtypDHVJBFGZCspD33awYcif6ucFbjQWBg@mail.gmail.com>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: PHP internals <internals@lists.php.net>, Remi Collet <remi@fedoraproject.org>
Content-Type: multipart/alternative; boundary=94eb2c122e705152e6053ffe314d
Subject: Re: [PHP-DEV] bug classification discussion
From: pierre.php@gmail.com (Pierre Joye)

--94eb2c122e705152e6053ffe314d
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi,

On Oct 28, 2016 10:33 PM, "Ferenc Kovacs" <tyra3l@gmail.com> wrote:
>
> On Fri, Oct 28, 2016 at 11:18 AM, Remi Collet <remi@fedoraproject.org>
> wrote:
>
> > Le 24/10/2016 =C3=A0 07:23, Stanislav Malyshev a =C3=A9crit :
> > > Hi!
> > >
> > > We have had a bunch of bugs recently which are essentially one and th=
e
> > > same issue: PHP 5.6 allows only int-sized strings, but many functions
> > > don't check the size of the string they produce. This can lead to int
> > > overflows inside php and also can break other libraries that also
assume
> > > string sizes are ints and this can cause all kinds of weirdness.
> > > However, these bugs are very unlikely to manifest in production
setting
> > > for one simple reason - they require PHP to run with no memory limit,
> > > and I haven't seen many setups that run with no memory limit. I'm not
> > > going to go into specifics here, since some of the issues are still
not
> > > fixed, but you can talk to me privately if you need examples or brows=
e
> > > changelogs of later 5.6 releases.
> > >
> > > A twin brother of this is in 7.0 where there are just integer
overflows
> > > in string size calculations. Usually that requires huge strings as
> > > inputs, so also requires running with no memory limit.
> > >
> > > These bugs are now treated as security issues,
> >
> > My main concern is not to know if we treat this bugs as security or not=
.
> >
> > It is mainly about "classification", and I think "low" risk bugs should
> > be fixed using the normal bug process (going in a RC versions) rather
> > than a specific process (fixed only at GA time), which should be
> > reserved for higher risk bugs.
> >
> >
> > Remi
> >
> >
> >
> I agree with Remi, these should be fixed via the normal development
process
> so we can catch any issues during the RC.
> These are basically the same issue, they can be exploited the same way
> (which I agree that has a low Exploitability) so we don't really gain muc=
h
> by keeping them until the final release but we risk a lot from skipping
the
> general QA process.

Thanks Stas for bringing that up.

It is indeed a case by case decision, however I fully agree with Remi and
Tyrael here, for the cases described by Stas initial post (or similar).

It is extremely hard to do it in a short time during final phases, let
alone the risk to create more damages by applying a bad fix.

About marking them as low security bugs or not. I have no strong opinion.
Maybe we could define what is a production environment and then define bugs
affecting this environment as security issues.

Cheers
Pierre

--94eb2c122e705152e6053ffe314d--