Bug #75494 [NEW]: php_openssl_setup_verify overzealously adds default files / dirs to trust store

From: luke at lerlacher dot de Operating system: PHP version: 7.2.0RC5 Package: OpenSSL related Bug Type: Bug Bug description:php_openssl_setup_verify overzealously adds default files / dirs to trust store Description: ------------ in interpreting $cainfo passed through the caller, php_openssl_setup_verify adds a default CA File to the store using X509_LOOKUP_load_file(file_lookup, NULL, X509_FILETYPE_DEFAULT) if no valid CA file was passed, and a default CA dir using X509_LOOKUP_add_dir(dir_lookup, NULL, X509_FILETYPE_DEFAULT) if no valid CA dir was passed. This means, if the user passes a single file location in $cainfo, indicating that they want only this file checked, the default ca dir will nevertheless be added to the store. Test script: --------------- <?php $ca = array( // a random ca-certificate that the signed mail was *not* signed with is required here '/etc/ca-certificates/extracted/cadir/T__RKTRUST_Elektronik_Sertifika_Hizmet_Sa__lay__c__s___H5.pem' ); // a pkcs7-signed email signed by a certificate in the default trust store is required $msg = 'signed_email.eml'; $verify = openssl_pkcs7_verify($msg, 0, $msg . '.cert', $ca); var_dump($verify); ?> Expected result: ---------------- The expected output is: bool(false) This indicates that the mail was not signed by any of the certificates passed in $cainfo. Actual result: -------------- The actual output is: bool(true) -- Edit bug report at https://bugs.php.net/bug.php?id=75494&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75494&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75494&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75494&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75494&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75494&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75494&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75494&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75494&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75494&r=support Expected behavior: https://bugs.php.net/fix.php?id=75494&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75494&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75494&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75494&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75494&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75494&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75494&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75494&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75494&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75494&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75494&r=mysqlcfg