full-disclosure - Re: {Java,PHP} Server Exploits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <17630.1297282391@localhost>
Date: Wed, 09 Feb 2011 15:13:11 -0500
From: Valdis.Kletnieks@...edu
To: Christian Sciberras <uuf6429@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, literalka@...a.eu
Subject: Re: {Java,PHP} Server Exploits

On Wed, 09 Feb 2011 20:54:41 +0100, Christian Sciberras said:

>     $f=floatval("2.2250738585072011e-308");
>     echo 'Try 2 => '.$f.'</br>';

> Plus, I'm a bit amazed such a bug exists in PHP - since converting to
> floating point is a trivial operation, it should have been limited and
> safe-guarded from the start.

Take a careful gander at that number, then go look at the floating point spec -
it's a specific corner case that isn't obviously trivial to get right (doing
floating point *right* is a lot harder than it looks - take a class on
numerical methods sometime, you spend 75% of your time dealing with rounding
errors in the last bit).

Having said that, anybody writing floating point support for a package should
probably google 'floating point paranoia' and learn what sort of things to test
for. :)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/