NSO group using the JBIG2 decompressor to evaluate arbitrary circuits
googleprojectzero.blogspot.com/2021/12/a-deep...111
ealf
u/ealf
googleprojectzero.blogspot.com
PHP 8 fixes ('foo' == 0), but keeps md5("FfHd0M7m") == 0
wiki.php.net/rfc/string_to_number_comparison1535
DOMDocument assumes the first element it sees is the document element and quietly stuffs all other content inside that.
3v4l.org/kG4sj96
"The PHP session code explicitly checks for symlinks [...] It does this by opening the file, then doing fstat() on the open file descriptor"
seclists.org/bugtraq/2014/Mar/23
seclists.org636
That preg_replace('/(.+)/e', 'foo("$1")') construct that got eBay hacked over a month ago (and Yahoo this week)? The official documentation still uses it as an example.
php.net/preg_replace
php.net639
array_product() returns the product of the values in an array. Guess what it returns if the array is empty.
php.net/array_product
php.net014
fgetcsv()/fputcsv() were both added in PHP 5.1.0. They are incompatible: fgetcsv() parses backslash escapes, but fputcsv() uses quote doubling (and does not escape backslashes).
codepad.org/YwM05DEV10311
<?php
class Box {
function getContentType() {
return get_class($this->content);
}
}
class Foo {
}
$x = new Box();
$x->content = new Foo();
echo $x->getContentType(), "\n"; // outputs 'Foo'
$x = new Box();
echo $x->getContentType(), "\n"; // outputs 'Box'
439
A Mark Twain Passage in Honor of the Anniversary of Christopher Hitchens’ Death
theweinerworks.com/?p=165360
6814
