cvs: php-src /ext/openssl openssl.c /ext/openssl/tests bug38261.phpt

pajoye Sun Jul 30 16:27:02 2006 UTC Modified files: /php-src/ext/openssl openssl.c /php-src/ext/openssl/tests bug38261.phpt Log: - MFB: #38261, openssl_x509_parse leaks with invalid certs http://cvs.php.net/viewvc.cgi/php-src/ext/openssl/openssl.c?r1=1.112&r2=1.113&diff_format=u Index: php-src/ext/openssl/openssl.c diff -u php-src/ext/openssl/openssl.c:1.112 php-src/ext/openssl/openssl.c:1.113 --- php-src/ext/openssl/openssl.c:1.112 Sun Jul 30 09:18:23 2006 +++ php-src/ext/openssl/openssl.c Sun Jul 30 16:27:02 2006 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: openssl.c,v 1.112 2006/07/30 09:18:23 pajoye Exp $ */ +/* $Id: openssl.c,v 1.113 2006/07/30 16:27:02 pajoye Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -770,6 +770,11 @@ return NULL; } + + if (!(Z_TYPE_PP(val) == IS_STRING || Z_TYPE_PP(val) == IS_OBJECT)) { + return NULL; + } + /* force it to be a string and check if it refers to a file */ convert_to_string_ex(val); http://cvs.php.net/viewvc.cgi/php-src/ext/openssl/tests/bug38261.phpt?r1=1.1&r2=1.2&diff_format=u Index: php-src/ext/openssl/tests/bug38261.phpt diff -u /dev/null php-src/ext/openssl/tests/bug38261.phpt:1.2 --- /dev/null Sun Jul 30 16:27:02 2006 +++ php-src/ext/openssl/tests/bug38261.phpt Sun Jul 30 16:27:02 2006 @@ -0,0 +1,34 @@ +--TEST-- +openssl key from zval leaks +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip"); +?> +--FILE-- +<?php +$cert = false; +class test { + function __toString() { + return "test object"; + } +} +$t = new test; + +var_dump(openssl_x509_parse("foo")); +var_dump(openssl_x509_parse($t)); +var_dump(openssl_x509_parse(array())); +var_dump(openssl_x509_parse()); +var_dump(openssl_x509_parse($cert)); +var_dump(openssl_x509_parse(new stdClass)); + +?> +--EXPECTF-- +bool(false) +bool(false) +bool(false) + +Warning: openssl_x509_parse() expects at least 1 parameter, 0 given in %s/bug38261.php on line %d +NULL +bool(false) + +Catchable fatal error: Object of class stdClass could not be converted to string in %s/bug38261.php on line %d