the PHP security bug patch is a nightmare, our server is patched but this thing looks more like a desperate attempt to patch hundreds of different leaks than a straightforward single bugfix, I do not trust that this is over…
2 Boosts
1 Like
@hikari Don't worry, someone will vibe-code a RIIR by tomorrow and then demand to be hailed a saviour.
![Chris [list of emoji]](https://nfts.freeradical.zone/accounts/avatars/109/127/168/397/951/576/original/e8a0b6da977923a8.jpeg "Chris [list of emoji]")
C-to-Rust already exists, fwiw. No idea how well it works on larger scale projects, though.
@hikari honestly the correct response to OOM in 99% of cases is just to abort the process because there's no sane recovery possible
I mean, you can use literally anything other than PHP and experience the same W. This problem is unique to PHP.
@argv_minus_one @azonenberg well, PHP tries to prevent a memory-based DoS at the runtime level, and other systems do not, and it's that feature which is implicated in the security issue, and so while, yes, you could use other systems, you do get the DoS vector with those. no RCE, though…
@hikari @argv_minus_one @azonenberg the way most systems handle this is that the process bails and a supervisor stands up a new one.
The nice ones do multiple worker processes handling connections, so one OOMing only kills that one worker's connections, and there's no visible downtime. (That is, assuming you're not getting spammed with OOM-causing requests.)
@astraluma @hikari @argv_minus_one @azonenberg
This is immediately where I went as well. I assume there must be a good reason for not doing it that way; I'm curious what it is.
@suetanvil @hikari @argv_minus_one @azonenberg the other major way is to bake your memory handling into your object lifecycle, and it's systemic that allocations can fail (and is processed as a normal error)
@astraluma @hikari @argv_minus_one @azonenberg
The problem with that is that you end up following each alloc with `if(!ptr){...}` which dramatically increases code complexity but also, it's often unclear what should go between the braces so you end up with thousands of potential bug sites instead of just the one.
TBH, I'm semi-convinced that the actual bug isn't really exploitable in real life and the panic is driven by AI hype.
@suetanvil @hikari @argv_minus_one @azonenberg it's not... not exploitable
But it's going to be tricky, and ASLR might mean payloads aren't repeatable
I hope you enjoyed my attempt to compress 1500 words about what I learned from skimming the patch into 280 characters, that was hellish, it's really hard not to sound like an LLM when you do this
uncompressed version with too much text to fit in the alt text field, sorry
PHP is a million or so lines of C code that pervasively used alloc functions that longjmp() on failure, so OOM bailout creates corrupted state. the fix uses fallible allocs and a global please-return-early OOM flag but requires touching Everything. completeness is impossible 😰😰😰