Re: HashDoS

Hi! > As linked in my first reply, there was a previous discussion on the > topic: http://markmail.org/message/ttbgcvdu4f7uymfb > The collision-counting approach that Yasuo references is linked at the > start of the first mail: > https://github.com/php/php-src/pull/1565 > > Collisions are counted during insertion operations. While we perform a > hashtable insertion, we first need to iterate over the existing buckets > for a certain hash to see if the insert is actually an update. The > implementation simply keeps track of how many buckets we inspect while > doing that. If the number is above a certain threshold, an error is > generated. So, count is per-lookup, then I think it's fine then. Sorry for misunderstanding it initially. Anything prevents us from merging it? If not, let's do it. -- Stas Malyshev smalyshev@gmail.com