the PHP security bug patch is a nightmare, our server is patched but this thing looks more like a desperate attempt to patch hundreds of different leaks than a straightforward single bugfix, I do not trust that this is over…
1 Boost
1 Like
I hope you enjoyed my attempt to compress 1500 words about what I learned from skimming the patch into 280 characters, that was hellish, it's really hard not to sound like an LLM when you do this
uncompressed version with too much text to fit in the alt text field, sorry
PHP is a million or so lines of C code that pervasively used alloc functions that longjmp() on failure, so OOM bailout creates corrupted state. the fix uses fallible allocs and a global please-return-early OOM flag but requires touching Everything. completeness is impossible 😰😰😰