Re: Re: 5.3.9, Hash DoS, release
| From: | Nikita Popov | Date: | Mon, 09 Jan 2012 16:54:18 +0000 |
| Subject: | Re: Re: 5.3.9, Hash DoS, release | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57301@lists.php.net to get a copy of this message | ||
On Mon, Jan 9, 2012 at 5:36 PM, Xinchen Hui <laruence@gmail.com> wrote:
> Hi:
> I have a new idea, which is simple and also works for Jason/serialized etc.
>
> That is Restricting a max length of a buckets list in a hash table.
>
> If a bucket's length exceed 1024, any insertion into this bucket
> will return failure and a warning will be generated.
>
> What do you think?
That seems like a very good approach (until we have randomization). It
would fix the issue in a generic way so not all functions need to be
patched one by one. It also will not hurt legit uses of many POST
variables (or large serialized arrays).