Re: HashDos protection
| From: | Stanislav Malyshev | Date: | Mon, 30 Nov 2015 23:21:06 +0000 |
| Subject: | Re: HashDos protection | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-89503@lists.php.net to get a copy of this message | ||
Hi!
> To fix the HashDos vulnerability for *all* cases (rather than just GET/POST
> parsing), I propose to introduce collision counting during hashtable
> insertion operations. This will throw a fatal error if the number of
> collisions during an insertion operation exceed a certain threshold.
>
> Implementation: https://github.com/php/php-src/pull/1565
This looks pretty cool. I'd support making the limit configurable
though, is there a reason why it's not?
--
Stas Malyshev
smalyshev@gmail.com