Better HashDos protection
| From: | Bob Weinand | Date: | Wed, 30 Dec 2015 22:13:57 +0000 |
| Subject: | Better HashDos protection | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-89928@lists.php.net to get a copy of this message | ||
Hey,
some time ago we had a discussion about HashDos protection initiated by Nikita. There just was one
major flaw that it still allowed to crash (fatal error) background processes with no chance to
intercept these.
Hence, an exception is thrown instead in array functions respectively (parse_str and json_decode)
the function is properly failed.
There still is a path reaching the fatal error, but it should never be reached under normal
operation via external input, and if it does, then it should be fixed too.
The pull request is found at https://github.com/php/php-src/pull/1706
This hopefully should eliminate this DoS vector completely.
Bob