Bug #63363 [Asn->Csd]: Curl silently accepts boolean true for SSL_VERIFYHOST

Edit report at https://bugs.php.net/bug.php?id=63363&edit=1 ID: 63363 Updated by: ircmaxell@php.net Reported by: ircmaxell@php.net Summary: Curl silently accepts boolean true for SSL_VERIFYHOST -Status: Assigned +Status: Closed Type: Bug Package: *Network Functions Operating System: All PHP Version: Irrelevant Assigned To: ircmaxell Block user comment: N Private report: N New Comment: Fixed in master / 5.4 branch Previous Comments: ------------------------------------------------------------------------ [2012-10-25 18:51:32] jawed@php.net Thx for creating the bug. Here is the pull request against master: https://github.com/php/php-src/pull/221 The change is minimal and the difference between ext/curl/interface.c from master to >5.4 is also minimal. This should be easy to cherry-pick from master. - JJ ------------------------------------------------------------------------ [2012-10-25 16:41:21] ircmaxell@php.net Description: ------------ The CURL option SSL_VERIFYHOST accepts a long value to indicate the verification that should be applied. The following values are valid: 0 - No verification 1 - Check a host is present in cert 2 - Check cert's host matches request's host The problem is that a boolean true is cast to a long 1. Therefore, code that does the following: curl_setopt($c, CURLOPT_SSL_VERIFYHOST, true) appears to be verifying the host. However, it's actually not. This can create security issues that are very hard to find by reading code. Test script: --------------- <?php $c = curl_init(); curl_setopt($c, CURLOPT_SSL_VERIFYHOST, true); Expected result: ---------------- The option is set to verify the host. Actual result: -------------- The option is set to 1, which does not verify the host. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=63363&edit=1