Re: Re: 5.3.9, Hash DoS, release
| From: | Rasmus Lerdorf | Date: | Tue, 10 Jan 2012 01:48:55 +0000 |
| Subject: | Re: Re: 5.3.9, Hash DoS, release | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57314@lists.php.net to get a copy of this message | ||
On 01/09/2012 05:28 PM, Xinchen Hui wrote:
>> I understand the difference. But large arrays are obviously the ones
>> that are prone to hitting the collision limits.
> Yes, but don't you think this is at least better than restricting
> number of elements? :)
The difference is the source. If, for example, I have a huge array
cached in APC's user cache which I built up over time and I apc_fetch()
it directly, I would not expect to run into any such limits. However, if
I hit an external source and parse untrusted xml/json data then I would
appreciate being able to protect myself from this sort of attack.
-Rasmus