php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  Fix GH-16433: Large values for openssl_csr_sign() $days overflow
This commit is contained in:
Christoph M. Becker
2024-10-16 11:09:57 +02:00
parent 9a4ec4015a 931762c626
commit ef1c3b82ff
3 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -56,6 +56,8 @@ PHP NEWS
- OpenSSL:
. Fixed bug GH-16357 (openssl may modify member types of certificate arrays).
(cmb)
. Fixed bug GH-16433 (Large values for openssl_csr_sign() $days overflow).
(cmb)
- PHPDBG:
. Fixed bug GH-16174 (Empty string is an invalid expression for ev). (cmb)

7
ext/openssl/openssl.c
View File

@@ -3281,6 +3281,11 @@ PHP_FUNCTION(openssl_csr_sign)
goto cleanup;
}
if (num_days < 0 || num_days > LONG_MAX / 86400) {
php_error_docref(NULL, E_WARNING, "Days must be between 0 and %ld", LONG_MAX / 86400);
goto cleanup;
}
if (PHP_SSL_REQ_PARSE(&req, args) == FAILURE) {
goto cleanup;
}
@@ -3349,7 +3354,7 @@ PHP_FUNCTION(openssl_csr_sign)
goto cleanup;
}
X509_gmtime_adj(X509_getm_notBefore(new_cert), 0);
X509_gmtime_adj(X509_getm_notAfter(new_cert), 60*60*24*(long)num_days);
X509_gmtime_adj(X509_getm_notAfter(new_cert), 60*60*24*num_days);
i = X509_set_pubkey(new_cert, key);
if (!i) {
php_openssl_store_errors();

17
ext/openssl/tests/gh16433.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
GH-16433 (Large values for openssl_csr_sign() $days overflow)
--EXTENSIONS--
openssl
--FILE--
<?php
$privkey = openssl_pkey_new();
$csr = openssl_csr_new([], $privkey);
var_dump(openssl_csr_sign($csr, null, $privkey, PHP_INT_MAX));
var_dump(openssl_csr_sign($csr, null, $privkey, -1));
?>
--EXPECTF--
Warning: openssl_csr_sign(): Days must be between 0 and %d in %s on line %d
bool(false)
Warning: openssl_csr_sign(): Days must be between 0 and %d in %s on line %d
bool(false)