Re: HashDoS
| From: | Stanislav Malyshev | Date: | Fri, 23 Sep 2016 01:16:12 +0000 |
| Subject: | Re: HashDoS | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-96104@lists.php.net to get a copy of this message | ||
Hi!
> The patch is not only targeting JSON. He just used JSON as an example.
>
> Every function generating arrays with keys based on user-defined input
> needs to be updated.
That looks like a very good way to make a lot of mistakes, miss a lot of
cases and end up playing whack-a-mole with covering all functions. Why
not just patch zend_hash.c and be done with it?
--
Stas Malyshev
smalyshev@gmail.com