com php-src: Fix bug #74651 - check EVP_SealInit as it can return -1: ext/openssl/openssl.c ext/openssl/ tests/74651.pem ext/openssl/tests/bug7465
1.phpt

Commit: 91826a311dd37f4c4e5d605fa7af331e80ddd4c3 Author: Stanislav Malyshev <stas@php.net> Mon, 19 Jun 2017 23:06:24 -0700 Committer: Joe Watkins <krakjoe@php.net> Thu, 6 Jul 2017 08:25:09 +0100 Parents: ec664bd26dff421dec09e05ae27f4e1031613348 Branches: PHP-7.1.7 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=91826a311dd37f4c4e5d605fa7af331e80ddd4c3 Log: Fix bug #74651 - check EVP_SealInit as it can return -1 Bugs: https://bugs.php.net/74651 Changed paths: M ext/openssl/openssl.c A ext/openssl/tests/74651.pem A ext/openssl/tests/bug74651.phpt Diff: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 47bafaf..8a925ce 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -5926,7 +5926,7 @@ PHP_FUNCTION(openssl_seal) buf = emalloc(data_len + EVP_CIPHER_CTX_block_size(ctx)); EVP_CIPHER_CTX_cleanup(ctx); - if (!EVP_SealInit(ctx, cipher, eks, eksl, &iv_buf[0], pkeys, nkeys) || + if (EVP_SealInit(ctx, cipher, eks, eksl, &iv_buf[0], pkeys, nkeys) <= 0 || !EVP_SealUpdate(ctx, buf, &len1, (unsigned char *)data, (int)data_len) || !EVP_SealFinal(ctx, buf + len1, &len2)) { efree(buf); diff --git a/ext/openssl/tests/74651.pem b/ext/openssl/tests/74651.pem new file mode 100644 index 0000000..4ed5905 --- /dev/null +++ b/ext/openssl/tests/74651.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIIEoDCCBAmgAwIBAgIBJzANBgkqhkiG9w0BAQQFADCBkDELMAkGA1UEFhMCUk8x +EDAOBgNVBAgTB1JvbWFuaWExEDAOBgNVBAcTB0NyYWlvdmExDzANBgNVBAoTBlNl +cmdpdTETMBEGA1UECxMKU2VyZ2l1IFNSTDESMBAGA1UEAxMJU2VyZ2l1IENBMSMw +IQYJKoZIhvcNAQkBFhRuX3NlcmdpdUBob3RtYWlsLmNvbTAeFw0wNDA1MTQxMzM0 +NTZaFw0wNTA1MTQxMzM0NTZaMIGaMQswCQYDVQQGEwJSTzEQMA4GA1UECBMHUm9t +YW5pYTEQMA4GA1UEBxMHQ3JhaW92YTETMBEGA1UEChMKU2VyZ2l1IFNSTDETMBEG +A1UECxMKU2VyZ2l1IFNSTDEYMBYGA1UEAxMPU2VyZ2l1IHBlcnNvbmFsMSMwIQYJ +KoZIhvcNAQkBFhRuX3NlcmdpdUBob3RtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF +AAOBjQAwgYkCgYEApNj7XXz8T8FcLIWpBniPYom3QcT6T7u0xRPHqtqzj5oboBYp +DJe5d354/y0gJTpiLt8+fTrPgWXnbHm3pOHgXzTcX6Arani0GDU0/xDi4VkCRGcS +YqX2sJpcDzAbmK9UDMt3xf/O1B8AJan3RfO0Bm3ozTEPziLMkmsiYr5b/L4CAwEA +AaOCAfwwggH4MAkGA1UdEwQCMAAwNQYJYIZIAYb4QgENBCgWJkZvciBHcmlkIHVz +ZSBvbmx5OyByZXF1ZXN0IHRhZyB1c2VyVGFnMBEGCWCGSAGG+EIBAQQEAwIF4DA/ +BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vbW9iaWxlLmJsdWUtc29mdHdhcmUucm86 +OTAvY2EvY3JsLnNodG1sMDUGCWCGSAGG+EIBCAQoFiZodHRwOi8vbW9iaWxlLmJs +dWUtc29mdHdhcmUucm86OTAvcHViLzAhBgNVHREEGjAYgRZzZXJnaXVAYmx1ZXNv +ZnR3YXJlLnJvMB0GA1UdDgQWBBSwp//5QRXeIzm93TEPl6CyonTg/DCBpwYDVR0j +BIGfMIGcoYGWpIGTMIGQMQswCQYDVQQGEwJSTzEQMA4GA1UECBMHUm9tYW5pYTEQ +MA4GA1UEBxMHQ3JhaW92YTEPMA0GA1UEChMGU2VyZ2l1MRMwEQYDVQQLEwpTZXJn +aXUgU1JMMRIwEAYDVQQDEwlTZXJnaXUgQ0ExIzAhBgkqhkiG9w0BCQEWFG5fc2Vy +Z2l1QGhvdG1haWwuY29tggEAMAsGA1UdDwQEAwIE8DAjBglghkgBhvhCAQIEFhYU +aHR0cDovLzYyLjIzMS45OC41Mi8wCwYDKgMEBAQ+52I0MA0GCSqGSIb3DQEBBAUA +A4GBAIBIOJ+iiLyQfNJEY+IMefayQea0nmuXYY+F+L1DFjSC7xChytgYoPNnKkhh +3dWPtxbswiqKYUnGi6y3Hi4UhDsOaDW29t2S305hSc2qgjOiNtRYQIVYQ8EHG1k7 +Fl63S7uCOhnVJt+4MnUK1N6/pwgsp+Z2GvEsDG1qCKnvNpf6 +-----END CERTIFICATE----- diff --git a/ext/openssl/tests/bug74651.phpt b/ext/openssl/tests/bug74651.phpt new file mode 100644 index 0000000..f86394b --- /dev/null +++ b/ext/openssl/tests/bug74651.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #74651: negative-size-param (-1) in memcpy in zif_openssl_seal() +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +?> +--FILE-- +<?php + +$inputstr = file_get_contents(__DIR__ . "/74651.pem"); +$pub_key_id = openssl_get_publickey($inputstr); +var_dump($pub_key_id); +var_dump(openssl_seal($inputstr, $sealed, $ekeys, array($pub_key_id, $pub_key_id), 'AES-128-ECB')); +?> +--EXPECTF-- +resource(%d) of type (OpenSSL key) +bool(false) \ No newline at end of file