[php-src] Issue #18986: OpenSSL backend: incorrect RAND_load_file() return value check

From: Date: Mon, 30 Jun 2025 21:11:32 +0000
Subject: [php-src] Issue #18986: OpenSSL backend: incorrect RAND_load_file() return value check
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-250350@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/18986 Author: botovq ### Description OpenSSL documents the return value of RAND_load_file() as ``` RETURN VALUES RAND_load_file() returns the number of bytes read or -1 on error. ``` (from code inspection this happens to be correct). The error check in php_openssl_load_rand_file() will however interpret an error as success. People relying on seeding the PRNG might therefore proceed without having added any entropy to the pool. These days the RAND(7) of OpenSSL is claimed to be robust enough without explicit seeding, so there should be no security impact to this, but it would probably still be good to fix it since it goes against expectations: https://github.com/php/php-src/blob/4a98b36416a8ebe0964d2e6ceca435c0d7f3f065/ext/openssl/openssl_backend_common.c#L443-L452 ### PHP Version ```plain PHP 8.4 ``` ### Operating System _No response_

« previous php.bugs (#250350) next »