Re: How does the PHP Ghost one-liner work?

On 30/01/2015 18:42, Robert Williams wrote:

% php -r '$e="0";for($i=0;$i<2500;$i++){$e="0$e";} gethostbyname($e);’ What’s not being discussed is how it works. From the naive viewpoint of a PHP end-user, I’d expect this one-liner to have the same effect: % php -r '$e="0$e"; gethostbyname($e);’ But it doesn’t. Can someone familiar with PHP’s internals explain why this code triggers the overflow, and whether it will actually do so reliably?

No need to be familiar with the internals, you just need to unroll the loop properly in your head: initialise: $e = "0"; => "0" $i=0: $e = "0$e"; => "0" . "0" => "00" $i=1: $e = "0$e"; => "0" . "00" => "000" and so on until you have 2501 zeroes when $i=2499 As Patrick points out, this is a really weird way of initialising that variable, and is presumably translated from another language by someone who doesn't know PHP. -- Rowan Collins [IMSoP]