A Patch for PHP 5.2.* to Prevent Hash-Collision Denial-of-Service Attacks中文EN

As introduced in my two previous articles (Denial-of-service attacks across various languages via constructed Hash collisions, An example of Hash collision in PHP arrays ), this attack method has a very high degree of harm and a very low cost to execute. A single desktop can easily bring down dozens, even hundreds, of servers.
After speaking with Pierre, the official dev group will not release PHP 5.2.18 for this, but there are still quite a few companies using 5.2. So I specially took the patch dmitry wrote for 5.4 and applied it to 5.2 separately.
If you're using 5.2 and are threatened by this kind of attack, you can apply the patch below. For PHP 5.3, you can consider upgrading to 5.3.9, which already includes this patch (since 5.3.9 is currently in RC state, if you don't want to upgrade, you can also refer to this patch and write one for 5.3 yourself):
https://github.com/laruence/laruence.github.com/tree/master/php-5.2-max-input-vars
A supplement (January 8, 2012): if you're using PHP on Windows, or for some other reason it's inconvenient to apply a patch, you can also mitigate the impact of this kind of attack by setting the PHP configuration max_input_time to a smaller value.
In addition, for other languages like java, ruby, etc., please also prepare your countermeasures in advance. Limiting post_size is a symptom-treatment rather than a root-cure, but it can be used as a temporary solution.
Thanks