From: K Date: Thu, 26 Mar 2015 18:05:38 +0000 (+0100) Subject: zend_hash_do_resize: amortizing the cost of compaction X-Git-Tag: php-7.1.0alpha3~25^2~93^2 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b3962ab94052254cec19034b77af0ca040b50fdd;p=php zend_hash_do_resize: amortizing the cost of compaction New implementation of hashtables introduced a compaction step which is triggered when a hashtable is full but it contains at least one deleted bucket. Therefore there is a possibility that a cleverly crafted code can trigger this compaction step (which takes time proportional to the size of hashtabe) by executing constatnt number of operations. When the hashtable is full, deletion and subsequent addition or single element triggers a table compaction and these two steps can be repeated ad infinitum. This might be avenue for a DOS attack. This patch allows compaction to be performed only if the hashtable contains at least 1/32 deleted elements, otherwise the hashtable is doubled in size. Linear amount of work caused by compaction is amortized over multiple malicious additions and deletions. --- diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 1fd3ccf3d9..09b8fa488e 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -777,7 +777,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht) IS_CONSISTENT(ht); HT_ASSERT(GC_REFCOUNT(ht) == 1); - if (ht->nNumUsed > ht->nNumOfElements) { + if (ht->nNumUsed > ht->nNumOfElements + (ht->nNumOfElements >> 5)) { /* additional term is there to amortize the cost of compaction */ HANDLE_BLOCK_INTERRUPTIONS(); zend_hash_rehash(ht); HANDLE_UNBLOCK_INTERRUPTIONS();