com php-src: Fix possible overflow in openssl_pbkdf2: e xt/openssl/openssl.c
| From: | Jakub Zelenka | Date: | Tue, 18 Aug 2015 18:46:59 +0000 |
| Subject: | com php-src: Fix possible overflow in openssl_pbkdf2: e xt/openssl/openssl.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-88649@lists.php.net to get a copy of this message | ||
Commit: 618c327a56b03449324cdaa0d630ea710aea22fd
Author: Jakub Zelenka <bukka@php.net> Tue, 18 Aug 2015 19:46:59 +0100
Parents: 000be61fb8a034b3ce2dc3d7bbfbc912295b86e9
Branches: master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=618c327a56b03449324cdaa0d630ea710aea22fd
Log:
Fix possible overflow in openssl_pbkdf2
Especially key_length would lead to the crash if it overflowed
to the negative value.
Changed paths:
M ext/openssl/openssl.c
Diff:
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index 1608e5d..1e03ce7 100644
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -4011,6 +4011,22 @@ PHP_FUNCTION(openssl_pbkdf2)
if (key_length <= 0) {
RETURN_FALSE;
}
+ if (INT_MAX < key_length) {
+ php_error_docref(NULL, E_WARNING, "key_length is too long");
+ RETURN_FALSE;
+ }
+ if (INT_MAX < iterations) {
+ php_error_docref(NULL, E_WARNING, "iterations is too long");
+ RETURN_FALSE;
+ }
+ if (INT_MAX < password_len) {
+ php_error_docref(NULL, E_WARNING, "password_len is too long");
+ RETURN_FALSE;
+ }
+ if (INT_MAX < salt_len) {
+ php_error_docref(NULL, E_WARNING, "salt_len is too long");
+ RETURN_FALSE;
+ }
if (method_len) {
digest = EVP_get_digestbyname(method);