The PHP strtod() denial of service bug

#1

Post by mikagrml » Wed, Jan 12, 2011, 1:41 PM UTC

The PHP strtod() denial of service bug
blog.andreas.org

Re: The PHP strtod() denial of service bug

#2

Post by wladimir » Wed, Jan 12, 2011, 2:23 PM UTC

The author might have something of a point in his rant that it is not exactly intuitive. When you specify 'double' you also expect computations to be done in 64 bit fp precision, so disabling the 80 bit fp flag or using SSE fp by default would have been a sane choice.

But the point remains that relying on any specific floating point semantics (in C, or any other language) is dangerous.

The potentially infinite loop in strtod was a bug, no matter how you spin it to blame the compiler. Iterative algorithms that must finish in limited time must always have a max # of iterations...

Re: The PHP strtod() denial of service bug

#3

Post by cosmo7 » Wed, Jan 12, 2011, 2:50 PM UTC

> GNU Mono

I see Miguel finally caved!

Re: The PHP strtod() denial of service bug

#4

Post by anonymoushn » Wed, Jan 12, 2011, 2:52 PM UTC

wladimir wrote: post #2

The author might have something of a point in his rant that it is not exactly intuitive. When you specify 'double' you also expect computations to be done in 64 bit fp precision, so disabling the 80 bit fp flag or using SSE fp by default would have been a sane choice. But the point remains that relying on any specific floating point semantics (in C, or any other language) is dangerous. The potentially infinite loop i…

It does not seem all that unreasonable to assume (in library code for dealing with 64-bit floating point numbers) that your 64-bit floating point numbers are actually 64-bit floating point numbers.

Re: The PHP strtod() denial of service bug

#5

Post by wladimir » Wed, Jan 12, 2011, 3:12 PM UTC

anonymoushn wrote: post #4

wladimir wrote: post #2

The author might have something of a point in his rant that it is not exactly intuitive. When you specify 'double' you also expect computations to be done in 64 bit fp precision, so disabling the 80 bit fp flag or using SSE fp by default would have been a sane choice. But the point remains that relying on any specific floating point semantics (in C, or any other language) is dangerous. The potentially infinite loop i…

It does not seem all that unreasonable to assume (in library code for dealing with 64-bit floating point numbers) that your 64-bit floating point numbers are actually 64-bit floating point numbers.

Well this shows again that assumptions, even if they look reasonable, can be very dangerous. The C standard is vague on these things, which leaves a lot of leeway for compilers.

Re: The PHP strtod() denial of service bug

#6

Post by [deleted] » Wed, Jan 12, 2011, 3:54 PM UTC

[deleted]

Re: The PHP strtod() denial of service bug

#7

Post by Zolomon » Wed, Jan 12, 2011, 4:01 PM UTC

How come I read this function out loud as String to Death?

Re: The PHP strtod() denial of service bug

#8

Post by jonhohle » Wed, Jan 12, 2011, 4:10 PM UTC

> forced millions of users...

While there may be millions of servers running PHP, I doubt millions of users (PHP programmers) were the ones upgrading them. I'd be shocked, if _most_ PHP programmers have ever installed PHP themselves.

Re: The PHP strtod() denial of service bug

#9

Post by snorkel » Wed, Jan 12, 2011, 4:12 PM UTC

I like how the author rants that the existence of this bug as totally unacceptable then suggests instead using clang compiler "for those who [...] can tolerate a few bugs"

Re: The PHP strtod() denial of service bug

#10

Post by btilly » Wed, Jan 12, 2011, 4:24 PM UTC

snorkel wrote: post #9

I like how the author rants that the existence of this bug as totally unacceptable then suggests instead using clang compiler "for those who [...] can tolerate a few bugs"

And yet from my point of view there is a world of difference between, We have bugs that cause problems that we have decided we don't care about and We have bugs we are not yet aware of, but we are responsive when you find them.

Even though I may encounter more bugs in the latter situation, I feel less pain when I encounter them. And I have the satisfaction that I'm somehow making the world a better place.