the PHP security bug patch is a nightmare, our server is patched but this thing looks more like a desperate attempt to patch hundreds of different leaks than a straightforward single bugfix, I do not trust that this is over…
2 Boosts
1 Like
@hikari Don't worry, someone will vibe-code a RIIR by tomorrow and then demand to be hailed a saviour.
![Chris [list of emoji]](https://nfts.freeradical.zone/accounts/avatars/109/127/168/397/951/576/original/e8a0b6da977923a8.jpeg "Chris [list of emoji]")
C-to-Rust already exists, fwiw. No idea how well it works on larger scale projects, though.
@hikari honestly the correct response to OOM in 99% of cases is just to abort the process because there's no sane recovery possible
I mean, you can use literally anything other than PHP and experience the same W. This problem is unique to PHP.
@argv_minus_one @azonenberg well, PHP tries to prevent a memory-based DoS at the runtime level, and other systems do not, and it's that feature which is implicated in the security issue, and so while, yes, you could use other systems, you do get the DoS vector with those. no RCE, though…
I hope you enjoyed my attempt to compress 1500 words about what I learned from skimming the patch into 280 characters, that was hellish, it's really hard not to sound like an LLM when you do this
uncompressed version with too much text to fit in the alt text field, sorry
PHP is a million or so lines of C code that pervasively used alloc functions that longjmp() on failure, so OOM bailout creates corrupted state. the fix uses fallible allocs and a global please-return-early OOM flag but requires touching Everything. completeness is impossible 😰😰😰