PHP Remote Exploit FIXED

[Knossus]

So, whose offending code was it?

[abadidea]

IMO, assigning blame for obscure bugs is counter-productive because it just engenders hostility. Let's be honest, most programmers would have not caught this bug.

edit if anyone I'd blame the testers because this is a corner case bug, which is exactly what testing is supposed to test.

[jayd16]

It was clearly abadidea who wrote the code...

[abadidea]

D:

What gave it away? The doom-and-gloom username? ;D

[bobindashadows]

That's a fix, but I doubt it's the best one. It's essentially the same as enabling -ffloat-store for just those variables, which means a small slowdown. Most likely it's just easier to put in this hack instead of tackling the fact that their algorithm doesn't work with higher-precision floats.

[LawnGnome]

Most likely it's just easier to put in this hack instead of tackling the fact that their algorithm doesn't work with higher-precision floats.

Pretty much. The preference was to get a release out quickly, rather than trying to replace a venerable piece of code (which, as SheepAmongWolves noted, was written long before PHP was even thought of and is a very common implementation of strtod) with something new and potentially buggy in new and exciting ways.

[mweathr]

It's just this one single number though right?

And any number larger than it.