[PHP-DEV] Benchmark Results for PHP Master 2015-08-13

Results for project php-src-nightly, build date 2015-08-13 10:30:27+03:00 commit: 18f2505830dd3170414b186f74c71c4d31998903 revision_date:2015-08-13 13:39:31+08:00 environment: Haswell-EP cpu: Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz 2x18 cores, stepping 2, LLC 45 MB

Re: [PHP-DEV] [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack

On 12 Aug 2015, at 00:43, Christoph Becker wrote: > On 10.08.2015 at 11:57, Craig Francis wrote: > >> You only have to skim read things like the second comment (with 27 up votes) >> on the PDO prepare page to see that these problems are happening all the >> time: >> >> >> http://php.net

Re: [PHP-DEV] [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack

> I don't think the proposal is useless nor ineffective. > Taint system is nice to have, but the proposal does not seem preferable > resolution. > Don't get me wrong. I agree with your discussion overall. > > I tend to dislike all or nothing choice for security related issues > especially, none

Re: [PHP-DEV] libpcre version requirements

On 12.08.2015 at 08:44, Anatol Belski wrote: >> -Original Message- >> From: Christoph Becker [mailto:cmbecke...@gmx.de] >> Sent: Tuesday, August 11, 2015 11:09 PM >> To: Anatol Belski ; 'PHP internals' >> >> Subject: Re: [PHP-DEV] libpcre version requirements >> >> Still, I would suggest

[PHP-DEV] Need help finding segfault in php 7

So I've been trying for a couple days to narrow down this bug: https://bugs.php.net/bug.php?id=70242 I can consistently recreate it with a complex test, but I have thus far not been able to find a pattern that helps me narrow down to a test script. I thought maybe I could reach out and see if I co

Re: [PHP-DEV] LDAP module requirements?

Am 12.08.2015 um 13:17 schrieb Andreas Heigl: Hi Rainer. Am 12.08.2015 um 13:00 schrieb Rainer Jung : Hi Côme, Am 11.08.2015 um 16:58 schrieb Côme BERNIGAUD: On 2015-08-11 00:36, Rainer Jung wrote: The current problems should be mostly around the above four compiler warnings. I can test any

[PHP-DEV] PCRE jit security hole WAS PCRE JIT stack size limit

On 23 July 2015 at 11:07, Christoph Becker wrote: > PHP7 supports PCRE's JIT compilation of patterns by default, which > mostly works fine. However, there are issues when the matching exceeds > the JIT stack limit, see bug #70110[1]. So to summarise and bring more people's attention to this con

Re: [PHP-DEV] LDAP module requirements?

Hi Rainer. Am 13.08.15 um 16:39 schrieb Rainer Jung: > Am 12.08.2015 um 13:17 schrieb Andreas Heigl: >> Hi Rainer. >> >>> Am 12.08.2015 um 13:00 schrieb Rainer Jung : >>> >>> Hi Côme, >>> Am 11.08.2015 um 16:58 schrieb Côme BERNIGAUD: > On 2015-08-11 00:36, Rainer Jung wrote: > The cu

[PHP-DEV] Warning (5.x) -> TypeError (7) for internal Constructors

Hi, I was trying to come up with an example for the https://wiki.php.net/rfc/internal_constructor_behaviour RFC and noticed some unexpected behavior. Based on one of the examples: In PHP 5.6 it will emit a Warning, and returns a unusable instance of ReflectionFunction, the latter of which shou

[PHP-DEV] Re: PCRE jit security hole WAS PCRE JIT stack size limit

On 13.08.2015 at 17:00, Dan Ackroyd wrote: > On 23 July 2015 at 11:07, Christoph Becker wrote: >> PHP7 supports PCRE's JIT compilation of patterns by default, which >> mostly works fine. However, there are issues when the matching exceeds >> the JIT stack limit, see bug #70110[1]. > > So to sum

Re: [PHP-DEV] libpcre version requirements

On 13 August 2015 at 04:35, Christoph Becker wrote: > On 12.08.2015 at 08:44, Anatol Belski wrote: >> >> [...] However look - >> http://w3techs.com/technologies/details/os-linux/all/all . From those, >> CentOS 5/6 releases are not even a year old and contain 6.6, 7.x but take >> 20% of all the

RE: [PHP-DEV] PCRE jit security hole WAS PCRE JIT stack size limit

> -Original Message- > From: Dan Ackroyd [mailto:dan...@basereality.com] > Sent: Thursday, August 13, 2015 5:00 PM > To: Christoph Becker > Cc: internals@lists.php.net > Subject: [PHP-DEV] PCRE jit security hole WAS PCRE JIT stack size limit > > On 23 July 2015 at 11:07, Christoph Becke

RE: [PHP-DEV] libpcre version requirements

> -Original Message- > From: a...@adamharvey.name [mailto:a...@adamharvey.name] On Behalf > Of Adam Harvey > Sent: Thursday, August 13, 2015 8:44 PM > To: Christoph Becker > Cc: Anatol Belski ; PHP internals > > Subject: Re: [PHP-DEV] libpcre version requirements > > On 13 August 2015