Post

i’m actually mad about the php OOM RCE. don’t get fucking cute in an error handler: fail fast and cleanly. right when the code enters an exceptional state you decide to start playing clever games with threads and pointers??? fuck off, take the OOM and restart

This post is unavailable.

21/10/26, 9:22 pm8 reposts133 likes

jpicone

@me.jamespicone.name

I saw the phrase "PHP uses longjmp() for out-of-memory (OOM) errors" in the github summary and was immediately all "oh no".

Kevin Riggle

@kevinr.free-dissociation.com

And it sounds like the patch actually gets _cuter_ and plays more clever games? I'm worried we're going to have to revisit this one

Siobhán 🪏

@shibbi.me

I’m going off an AI summary so count accordingly, but I hear it’s actually less cute; it defers a soft OOM to the next VM savepoint, and stops playing with arbitrary C frames.

Kevin Riggle

@kevinr.free-dissociation.com

I'm reminded of the first Shellshock patch which tried to preserve the original functionality, which no one used, so we wound up cooking up a patch that just removed the offending feature entirely

Alberto Albero

@levistico.bsky.social

> fail fast and cleanly That is unfortunately the exact opposite of the mentality behind php (trudge forwards at all costs)

Jim Calabro ♟️

@calabro.io

No way to prevent this etc etc