Hi Brian, On 24 October 2026 21:59:35 BST, Brian Nguyen <[email protected]> wrote: > The vulnerable pattern — count-before-alloc + OOM bailout — > could have been modeled and fuzzed if the invariants of > HashTable and ZendMM were specified outside of C.
It seems to be that the memory manager and internal structures are exactly the part that would vary between implementations. PHPNG (the basis of 7.0) heavily rewrote exactly those parts; an implementation on top of another runtime like .net or JVM would naturally make use of their underlying memory management; a rewrite in fully-checked Rust or Zig would use different mechanisms than one in C. A meaningful spec would cover all of those, asserting that the behaviour observed from the outside matches. I can't see how a specification would have helped here, any more than the HTML Specification helps prevent memory management bugs in browser implementations. >.NET is a useful counter-example, not because "Microsoft >exists", but because it chose to keep alternative runtimes. Microsoft employs about 200_000 people. If 0.01% of those are paid to work full time on .NET, that's still twice as many as have ever been paid to work full time on PHP. If someone came along offering to create a competing implementation of PHP, I would beg them to instead spend the effort improving the one we already have. Regards, Rowan Tommins [IMSoP]
