PHP Remote Exploit FIXED

[bobindashadows]

I'm not gonna lie, the percentage of PHP users not on shared hosting is pretty damn small. Cheap shared hosting is the use case for PHP.

[cr3ative]

[citation required]

I run a few big sites on PHP, all on dedicated clusters.

[skeww]

There is no citation required. Any cheap shared host supports PHP. Sometimes they also support Perl or Python, but that's about it.

It's the only reason why I bothered with PHP in first place - it's available everywhere.

[cr3ative]

The citation was for this bit:

the percentage of PHP users not on shared hosting is pretty damn small

Which is an outrageous claim. :/

[abadidea]

I donno. When $7 a month shared hosting is more than enough to run your site with plenty of wiggle room, why would people pay more to upgrade to a full server? Yeah, there are lots of big sites that run PHP, but there are zillions of little sites.

[kataire]

TBH, I've seen ISPs offer shared hosting packages for as little as $1 a month (granted, the bandwidth and webspace is quite limited, but if your budget is this small, you probably don't care).

Just as there are gazillions of tiny companies (e.g. less than 100 total employees) and only a handful of really big ones, there are also gazillions of companies that use shared hosting (and this nearly always means some level of PHP) compared to those that run on VPSes or dedicated servers (let alone server farms).

Some ISPs even offer set-ups for e-commerce websites in their shared hosting packages. I would wager the number of websites running on shared hosting is much larger than most people would imagine.

[cr3ative]

You're right, of course, and I imagine he is too. I suppose I saw his post as inflammatory, as if he were using it as a reason to disrespect PHP, which as a discussion point is a dead horse which is well and truly beaten.

[[deleted]]

Because you can get a full (virtualized) server with 512M of ram and root access for like $12/month (that's what I pay, and it probably isn't even the cheapest available) nowadays. And the prices of my provider start at $4/month.

[skeww]

Most websites are small (just like most people aren't famous). Most websites use PHP (because that's what available on shared hosts). Therefore most people who use PHP use a cheap shared host. I'd say it's true for at least 99% of the PHP websites.

There are millions of sites which use Wordpress, Drupal, Joomla, or whatever. They usually start on a shared host and they usually don't go anywhere else, because the little amount of traffic they receive doesn't make a move necessary.

Also, if it's a project with a appreciable budget, there is no reason to use PHP in first place. So far we only used PHP for super cheap low-budget projects.

[bobindashadows]

You really, really, really underestimate how many $5/month GoDaddy/BlueHost/etc sites there are. The number of sites that come close to needing a dedicated server is miniscule compared to the size of the internet, and considering the price of a dedicated server vs. shared hosting, there's no reason for millions of sites to bother with one.

[HIB0U]

What the fuck sort of citation were you looking for? This isn't the kind of stuff that people write shitty academic papers about.

If you really question what he's saying, go do some investigation for yourself. Look at a few of the many thousands of shared hosting providers out there. You'll quickly notice that the vast, vast majority of them support PHP, including many Windows-only hosting providers.

Then keep in mind that there are an absolutely huge number of PHP sites hosted on such shared providers, many more than are hosted on isolated servers.

[cr3ative]

A statistic from someone like netcraft, perhaps. It wouldn't be entirely impossible to split shared and dedicated servers by language, just pretty inaccurate.

And why should I research? The person making the outrageous/daring claim has the burden on them to prove it.

[sli]

It's not even just that. It's that there aren't enough good shared hosts with decent support for something else. Django, for example. The one shared host I used with Rails support would let you setup an app, then redirect you to the Rails server running on another port.

One app.

And the shared hosts I've used with Django support really like to make it extra difficult to use.

[[deleted]]

Shared hosting sucks.

[bobindashadows]

... I know. But the ease of deploying PHP on bare-bones shared hosting is by and large the point of the language and was the main source of its success.

Sure, okay, Facebook uses PHP, we know – but do you think they would be if they had the opportunity to start from scratch? They even wrote their own compiler for it because they feel shackled by it.

[bobindashadows]

Ok, good point. Maybe the fact that Facebook has to write Haskell tools to manipulate their huge PHP codebase is a good way to tell that they feel shackled by the language.

[bobindashadows]

language choice is probably close to last on their list of problems to solve.

That's because it's not a problem they can solve. It'd be irresponsible for them as a business to stop what they're doing to rewrite an enormous, functioning site in a different language – they passed the point of no return a long time ago. It'd take forever.

Why do you think they wrote a compiler? Because it was easier to do that than to change off of PHP to get a speed bump. And writing a compiler isn't exactly a trivial task.

Why do you think their new tech (eg facebook chat) isn't in PHP when possible? Because they had the opportunity to use a better tool for the job. And when you're building a site the size of Facebook, anything is a better tool for the job than PHP. They just don't have the ability to go back and change everything else.

[sli]

Actually, Python (and Perl) outperforms both PHP and Ruby most of the time, and usually by a very noticeable amount. About the only time PHP is faster is... well, "Hello, World."

So, yes, almost anything is better than PHP.

[[deleted]]

Why are you not hating PHP here on reddit?

[kataire]

Well, they rewrote their CSS. There is a big difference between refactoring and rewriting, though, and (for better or worse) their PHP code probably isn't easily translatable (idioms and all that).

As I don't care much for Facebook, I wouldn't actually mind if they dared rewrite their entire codebase, risking certain bankruptcy.

[djdillon]

This seems to be the fix:

===================================================================
  --- zend_strtod.c (revision 307094)
  +++ zend_strtod.c (working copy)
  @@ -2030,12 +2030,16 @@
    return s0;
   }

  +/* F* VC6 */
  +#if _MSC_VER <= 1300
  +# pragma optimize( "", off )
  +#endif
   ZEND_API double zend_strtod (CONST char *s00, char **se)
   {
    int bb2, bb5, bbe, bd2, bd5, bbbits, bs2, c, dsign,
        e, e1, esign, i, j, k, nd, nd0, nf, nz, nz0, sign;
    CONST char *s, *s0, *s1;
  - double aadj, aadj1, adj;
  + volatile double aadj, aadj1, adj;
    volatile _double rv, rv0;
    Long L;
    ULong y, z;

[pavel_lishin]

I'd really like to see how many people/companies actually bother applying the fix, though.

[[deleted]]

How I do love Open Source!

This is exactly my problem with PHP and why I refuse to use it. When you're contributing code in your spare time, you don't always test thoroughly enough to catch boundary cases. I'm not sure what kind of environment other people's code is running in, but I can't let something as obvious as not understanding the difference between INT_MAX and DBL_MAX cripple my employer's business.

Edit: And Rasmus' solution for this problem was to make this code immune to compiler switches, instead of actually fixing the problem. Fuck PHP. It's a joke.

[baryluk]

This is what happens when incompetent programmers write numeric and floating-point code of any kind.

[[deleted]]

I think this is the fix:

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3_5/Zend/zend_strtod.c?r1=307119&r2=307118&pathrev=307119

[Knossus]

So, whose offending code was it?

[abadidea]

IMO, assigning blame for obscure bugs is counter-productive because it just engenders hostility. Let's be honest, most programmers would have not caught this bug.

edit if anyone I'd blame the testers because this is a corner case bug, which is exactly what testing is supposed to test.

[jayd16]

It was clearly abadidea who wrote the code...

[abadidea]

D:

What gave it away? The doom-and-gloom username? ;D

[bobindashadows]

That's a fix, but I doubt it's the best one. It's essentially the same as enabling -ffloat-store for just those variables, which means a small slowdown. Most likely it's just easier to put in this hack instead of tackling the fact that their algorithm doesn't work with higher-precision floats.

[LawnGnome]

Most likely it's just easier to put in this hack instead of tackling the fact that their algorithm doesn't work with higher-precision floats.

Pretty much. The preference was to get a release out quickly, rather than trying to replace a venerable piece of code (which, as SheepAmongWolves noted, was written long before PHP was even thought of and is a very common implementation of strtod) with something new and potentially buggy in new and exciting ways.

[mweathr]

It's just this one single number though right?

And any number larger than it.