php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2'

Browse Source 
* PHP-8.2:
  Add missing check on EVP_VerifyUpdate() in phar util
This commit is contained in:
Niels Dossche
2023-07-09 23:00:49 +02:00
parent a7f7022359 3ee2ade917
commit 15bdc85e00
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ext/phar/util.c
View File

@@ -1605,7 +1605,9 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type,
php_stream_seek(fp, 0, SEEK_SET);
while (read_size && (len = php_stream_read(fp, (char*)buf, read_size)) > 0) {
EVP_VerifyUpdate (md_ctx, buf, len);
if (UNEXPECTED(EVP_VerifyUpdate (md_ctx, buf, len) == 0)) {
goto failure;
}
read_len -= (zend_off_t)len;
if (read_len < read_size) {
@@ -1614,6 +1616,7 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type,
}
if (EVP_VerifyFinal(md_ctx, (unsigned char *)sig, sig_len, key) != 1) {
failure:
/* 1: signature verified, 0: signature does not match, -1: failed signature operation */
EVP_PKEY_free(key);
EVP_MD_CTX_destroy(md_ctx);