pajoye Sun Jul 30 16:27:02 2006 UTC
Modified files:
/php-src/ext/openssl openssl.c
/php-src/ext/openssl/tests bug38261.phpt
Log:
- MFB: #38261, openssl_x509_parse leaks with invalid certs
http://cvs.php.net/viewvc.cgi/php-src/ext/openssl/openssl.c?r1=1.112&r2=1.113&diff_format=u
Index: php-src/ext/openssl/openssl.c
diff -u php-src/ext/openssl/openssl.c:1.112 php-src/ext/openssl/openssl.c:1.113
--- php-src/ext/openssl/openssl.c:1.112 Sun Jul 30 09:18:23 2006
+++ php-src/ext/openssl/openssl.c Sun Jul 30 16:27:02 2006
@@ -18,7 +18,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: openssl.c,v 1.112 2006/07/30 09:18:23 pajoye Exp $ */
+/* $Id: openssl.c,v 1.113 2006/07/30 16:27:02 pajoye Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -770,6 +770,11 @@
return NULL;
}
+
+ if (!(Z_TYPE_PP(val) == IS_STRING || Z_TYPE_PP(val) == IS_OBJECT)) {
+ return NULL;
+ }
+
/* force it to be a string and check if it refers to a file */
convert_to_string_ex(val);
http://cvs.php.net/viewvc.cgi/php-src/ext/openssl/tests/bug38261.phpt?r1=1.1&r2=1.2&diff_format=u
Index: php-src/ext/openssl/tests/bug38261.phpt
diff -u /dev/null php-src/ext/openssl/tests/bug38261.phpt:1.2
--- /dev/null Sun Jul 30 16:27:02 2006
+++ php-src/ext/openssl/tests/bug38261.phpt Sun Jul 30 16:27:02 2006
@@ -0,0 +1,34 @@
+--TEST--
+openssl key from zval leaks
+--SKIPIF--
+<?php
+if (!extension_loaded("openssl")) die("skip");
+?>
+--FILE--
+<?php
+$cert = false;
+class test {
+ function __toString() {
+ return "test object";
+ }
+}
+$t = new test;
+
+var_dump(openssl_x509_parse("foo"));
+var_dump(openssl_x509_parse($t));
+var_dump(openssl_x509_parse(array()));
+var_dump(openssl_x509_parse());
+var_dump(openssl_x509_parse($cert));
+var_dump(openssl_x509_parse(new stdClass));
+
+?>
+--EXPECTF--
+bool(false)
+bool(false)
+bool(false)
+
+Warning: openssl_x509_parse() expects at least 1 parameter, 0 given in
%s/bug38261.php on line %d
+NULL
+bool(false)
+
+Catchable fatal error: Object of class stdClass could not be converted to
string in %s/bug38261.php on line %d
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
