[php-src] PR #23999: early salt validation to prevent memory leak
| From: | adapik | Date: | Tue, 29 Sep 2026 17:56:11 +0000 |
| Subject: | [php-src] PR #23999: early salt validation to prevent memory leak | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38947@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23999
Author: adapik
The salt length check ran after the key and digest were loaded. When the check failed, the function
returned early and never freed them.
in
openssl_verify it was done eariler, so i moved it also eairlier
The leak was introduced in ae487f4f666 (added $salt_length), so this targets PHP-8.6.