Re: [ZEND-ENGINE-CVS] cvs: ZendEngine2(PHP_5_2) / zend.h zend_API.c zend_builtin_functions.c zend_compile.c zend_execute_API.c zend_object_handlers.c /tests bug43128.phpt php-src NEWS

Marcus Boerger wrote:
> Hello Stanislav,
> 
>   to me the questions are more like:
> 
> a) Do we really need unlimited function/method/const/variable names?

It is possible to pass function or class name directly form php script.

<?php
call_user_func(str_repeat("#@%@#$!!@#", 65536));
?>

I think we have a lot of internal functions that accepts callback names.
Should we fix each such function? Or should we just catch the real problem?

> b) Would it not be much better to limit those and get rid of the additional
> overhead

If we already caught the problem. why do we need additional limits? It's 
a check anyway that makes will makes the same slowdown as provided solution.

> c) Is it safe to use something that is marked as dangerous?

The patch reduces danger without significant slowdown.

BTW: this long discussion gave me the though.
In PHP_5_3 and HEAD we have a segmented-vm-stack, may be we can use this 
stack for our-own 100% safe alloca() implementation. Of course it will 
little bit slower.
Anyway, it's just an idea about future and we need to fix this issue in 
PHP_5_2.

Thanks. Dmitry.

> marcus
> 
> In case my opinion is not clear. My take is that we limit the length and go
> with alloca and drop the overhead.
> 
> Saturday, February 16, 2008, 1:27:36 AM, you wrote:
> 
>> Hi!
> 
>>>   well in this case as well as in most other cases we deal with unrestricted
>>> lengths. So adding an additional complexity does not seem very good imo.
> 
>> It is important to understand the difference between potentially 
>> unlimited length - which can come from malicious or very rare 
>> exceptional input - and 99.9% of regular cases where the input is very 
>> short. The improvement we get on those frequent cases covers for extra 
>> check to accomodate the very infrequent case of the long string.
>> -- 
>> Stanislav Malyshev, Zend Software Architect
>> [email protected]   http://www.zend.com/
>> (408)253-8829   MSN: [email protected]
> 
> 
> 
> 
> Best regards,
>  Marcus
>