Re: HashDos protection
| From: | Niklas Keller | Date: | Thu, 26 Nov 2015 19:35:08 +0000 |
| Subject: | Re: HashDos protection | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-89457@lists.php.net to get a copy of this message | ||
>
> 3. (Fatal error on many collisions). While the two previous options try to
> ensure that hashtables stay efficient regardless of the used keys, the last
> option aims to simply detect malicious array keys and abort the script in
> such a case.
>
> This is done by counting the number of collisions during hashtable
> insertion operations and throwing a fatal error if this collisions count
> exceeds a certain threshold.
>
Would this be a catchable Error (implementing Throwable) or a real fatal?
Having a real fatal could lead to a DOS in Aerys as you'd be able to crash
workers with carefully crafted input variables then.
Thanks, Niklas