Since the official dev group won't ship PHP 5.2.18 for the hash-collision DoS (CVE-2011-4885) but many are still on 5.2, I backported dmitry's 5.4 patch (max_input_vars) to 5.2. For 5.3, upgrade to 5.3.9. On Windows or where patching is hard, lowering max_input_time helps. Limiting post_size is only a stopgap for other languages.
with 0 CommentIn the previous article I described how hash collisions can be used to mount DoS attacks against many languages (PHP, Java, Ruby, etc.) but gave no concrete example. Here, translated from nikic's 'Supercolliding a PHP array', is one: inserting 65536 specially constructed keys into a PHP array takes 30+ seconds versus 0.1 seconds for ordinary keys. Every insertion collides, so the array's underlying hash table degenerates into a linked list and the total traversals become O(n^2). Laruence then explains how the keys are built — for numeric keys the hash is index & tableMask, hashtable sizes are powers of two, so keys 0, 64, 128, 192... all hash to bucket 0.
with 0 Commentdmitry added the max_input_vars directive to PHP 5.4 right before its release, to defend against the hash-collision DoS (CVE-2011-4885): crafted POST keys turn the hash table into a linked list, pegging CPU. Lists the affected and fixed versions of PHP, Java, Ruby, Python, Tomcat, Jetty and more, per the OCert advisory.
with 0 CommentFollow-up on the PHP 5.4 chained-string-offsets change: for a string, isset($a["foo"]) now returns false and empty() true, but reading still yields $a[0] plus a warning for compatibility. bool/double/null keys behave as before but emit a Notice; numeric string indexes are unchanged.
with 0 CommentPHP stores values in a zval; integers go in long lval (32 or 64 bits depending on platform) while floats go in double dval (always 64-bit IEEE 754). This explains literal-to-zval conversion, precision loss past PHP_INT_MAX, and why a long survives a long->double->long round trip only below 2^53-1.
with 0 CommentA follow-up to debugging PHP core dumps: I improved the PHP 5.4 .gdbinit so that zbacktrace now shows the full function call stack including arguments, and printzv lets you expand arrays and objects. Includes the NTS workaround for inspecting objects from a core file.
with 0 CommentThanks to Ruilog again for his work on the second benchmark of Yaf 2.1. Yaf 2.1 did a lot of work to improve performance and reduce memory usage — here are the results, compared against other PHP frameworks.
with 0 CommentPHP 5.4 finally allows directly calling methods or accessing properties on a freshly instantiated object: (new Foo())->bar(). Laruence explains why this resisted a grammar patch for years (a shift/reduce conflict), why the parentheses are required, and Felipe's RFC that landed it.
with 0 CommentA deep dive into zend_alloc: how Zend MM splits memory into small vs large blocks, the small-block free_buckets pointer-packing trick (ZEND_MM_SMALL_FREE_BUCKET), and the large_free_buckets key-tree (indexed by the high bit of the size via bsr) with bitmap-assisted best-fit search. Written because existing references — including TIPI — got it wrong.
with 0 Comment