[php-src] Issue #18986: OpenSSL backend: incorrect RAND_load_file() return value check
| From: | botovq | Date: | Mon, 30 Jun 2025 21:11:32 +0000 |
| Subject: | [php-src] Issue #18986: OpenSSL backend: incorrect RAND_load_file() return value check | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-250350@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/18986
Author: botovq
### Description
OpenSSL documents the return value of
RAND_load_file() as
```
RETURN VALUES
RAND_load_file() returns the number of bytes read or -1 on error.
```
(from code inspection this happens to be correct).
The error check in php_openssl_load_rand_file() will however interpret an error as
success. People relying on seeding the PRNG might therefore proceed without having added any entropy
to the pool. These days the RAND(7) of OpenSSL is claimed to be robust enough without explicit
seeding, so there should be no security impact to this, but it would probably still be good to fix
it since it goes against expectations:
https://github.com/php/php-src/blob/4a98b36416a8ebe0964d2e6ceca435c0d7f3f065/ext/openssl/openssl_backend_common.c#L443-L452
### PHP Version
```plain
PHP 8.4
```
### Operating System
_No response_