Inspired by the RFC:Taint (which required patching PHP's data structures), I built the Taint extension instead. Enabled via php.ini (not for production), it warns whenever unescaped $_GET/$_POST/$_COOKIE data reaches echo/print/system/exec or SQL/file operations — a runtime complement to static analysis.
with 0 CommentThe 5.3.9 fix for the Hash Collisions DoS introduced a new RCE: at max_input_vars+1, an uninitialized gpc_element_p is dereferenced, and forging x as a string lets it be misread as a HashTable whose pDestructor points to attacker-controlled memory — arbitrary code execution in theory, blocked in practice by ASLR+NX. Fixed in 5.3.10.
with 0 CommentA classic debate: exceptions vs error codes. Error codes have poor information, may force signature changes, and can be silently ignored; exceptions carry rich context and survive without signature changes, but are slightly costlier and risk scattered uncaught exceptions. For small short-lived modules, skip them; for large systems, prioritize extensibility and maintainability.
with 0 CommentWhen a program exits with -1, PHP (and the shell) report 255. Because the exit value lives in the high 8 bits of the 16-bit wait() status and is read as unsigned, -1 wraps to 255. Includes the full table of Linux exit-code conventions (1, 2, 126, 127, 128+n, 130, 255).
with 0 CommentKnowing PHP's history helps you understand the path it took to become what it is today. Reproduced from the PHP Manual: the origins in PHP/FI (Rasmus Lerdorf's 1995 Personal Home Page Tools, written in Perl then C), the leap to PHP 3 (Andi Gutmans and Zeev Suraski's rewrite, extensibility, the recursive acronym PHP: Hypertext Preprocessor, released June 1998), PHP 4 (the Zend Engine, May 2000, HTTP sessions, output buffering), and PHP 5 (Zend Engine 2, new object model, July 2004).
with 0 CommentSince the official dev group won't ship PHP 5.2.18 for the hash-collision DoS (CVE-2011-4885) but many are still on 5.2, I backported dmitry's 5.4 patch (max_input_vars) to 5.2. For 5.3, upgrade to 5.3.9. On Windows or where patching is hard, lowering max_input_time helps. Limiting post_size is only a stopgap for other languages.
with 0 CommentIn the previous article I described how hash collisions can be used to mount DoS attacks against many languages (PHP, Java, Ruby, etc.) but gave no concrete example. Here, translated from nikic's 'Supercolliding a PHP array', is one: inserting 65536 specially constructed keys into a PHP array takes 30+ seconds versus 0.1 seconds for ordinary keys. Every insertion collides, so the array's underlying hash table degenerates into a linked list and the total traversals become O(n^2). Laruence then explains how the keys are built — for numeric keys the hash is index & tableMask, hashtable sizes are powers of two, so keys 0, 64, 128, 192... all hash to bucket 0.
with 0 Commentdmitry added the max_input_vars directive to PHP 5.4 right before its release, to defend against the hash-collision DoS (CVE-2011-4885): crafted POST keys turn the hash table into a linked list, pegging CPU. Lists the affected and fixed versions of PHP, Java, Ruby, Python, Tomcat, Jetty and more, per the OCert advisory.
with 0 CommentFollow-up on the PHP 5.4 chained-string-offsets change: for a string, isset($a["foo"]) now returns false and empty() true, but reading still yields $a[0] plus a warning for compatibility. bool/double/null keys behave as before but emit a Notice; numeric string indexes are unchanged.
with 0 Comment