[pull] master from php:master#835
Merged
pull[bot] merged 31 commits intoturkdevops:masterfrom Apr 4, 2026
Merged
Conversation
EVP_DigestInit() cannot handle a NULL argument:
```
==8028==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x7fade0826b2d bp 0x7ffcae8236f0 sp 0x7ffcae8236c0 T0)
==8028==The signal is caused by a READ memory access.
==8028==Hint: address points to the zero page.
#0 0x7fade0826b2d (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1e3b2d) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#1 0x5584fb314601 in zif_openssl_digest /work/php-src/ext/openssl/openssl.c:4459
#2 0x5584fc0b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#3 0x5584fc3e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#4 0x5584fc540995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#5 0x5584fc5558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#6 0x5584fc6ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#7 0x5584fc0ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#8 0x5584fc0ecccb in php_execute_script /work/php-src/main/main.c:2685
#9 0x5584fc6bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#10 0x5584fc6c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#11 0x7fade02c51c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#12 0x7fade02c528a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#13 0x5584fb209b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
Closes GH-21019.
```
==59541==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x7f9fafba9b69 bp 0x7ffe3fd87700 sp 0x7ffe3fd876e8 T0)
==59541==The signal is caused by a WRITE memory access.
==59541==Hint: address points to the zero page.
#0 0x7f9fafba9b69 in BIO_up_ref (/lib/x86_64-linux-gnu/libcrypto.so.3+0xedb69) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#1 0x7f9fafbb4ac2 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xf8ac2) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#2 0x7f9fafc886f0 (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1cc6f0) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#3 0x7f9fafc88aa6 in OSSL_ENCODER_to_bio (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1ccaa6) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#4 0x7f9fafdaeadf in PEM_write_bio_PrivateKey_ex (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2f2adf) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#5 0x7f9fafdaebc7 in PEM_write_bio_PrivateKey (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2f2bc7) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#6 0x555dbe4ff75f in zif_openssl_pkey_export /work/php-src/ext/openssl/openssl.c:2216
#7 0x555dbf2b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#8 0x555dbf5e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#9 0x555dbf740995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#10 0x555dbf7558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#11 0x555dbf8ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#12 0x555dbf2ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#13 0x555dbf2ecccb in php_execute_script /work/php-src/main/main.c:2685
#14 0x555dbf8bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#15 0x555dbf8c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#16 0x7f9faf73e1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#17 0x7f9faf73e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#18 0x555dbe409b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
Closes GH-21021.
Example ASAN report:
```
==55442==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x7f73a6413b69 bp 0x7ffe666f6010 sp 0x7ffe666f5ff8 T0)
==55442==The signal is caused by a WRITE memory access.
==55442==Hint: address points to the zero page.
#0 0x7f73a6413b69 in BIO_up_ref (/lib/x86_64-linux-gnu/libcrypto.so.3+0xedb69) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#1 0x7f73a641eac2 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xf8ac2) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#2 0x7f73a64f26f0 (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1cc6f0) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#3 0x7f73a64f2aa6 in OSSL_ENCODER_to_bio (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1ccaa6) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#4 0x7f73a6618adf in PEM_write_bio_PrivateKey_ex (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2f2adf) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#5 0x7f73a6618bc7 in PEM_write_bio_PrivateKey (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2f2bc7) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#6 0x559b16af882b in zif_openssl_pkcs12_read /work/php-src/ext/openssl/openssl.c:1520
#7 0x559b178b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#8 0x559b17be024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#9 0x559b17d40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#10 0x559b17d558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#11 0x559b17eba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#12 0x559b178ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#13 0x559b178ecccb in php_execute_script /work/php-src/main/main.c:2685
#14 0x559b17ebfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#15 0x559b17ec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#16 0x7f73a5fa81c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#17 0x7f73a5fa828a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#18 0x559b16a09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
Closes GH-21022.
…ails
```
==41743==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000090 (pc 0x557f134d3acf bp 0x7ffd4d5bc1f0 sp 0x7ffd4d5bb870 T0)
==41743==The signal is caused by a READ memory access.
==41743==Hint: address points to the zero page.
#0 0x557f134d3acf in php_stream_url_wrap_http_ex /work/php-src/ext/standard/http_fopen_wrapper.c:580
#1 0x557f134d857e in php_stream_url_wrap_http /work/php-src/ext/standard/http_fopen_wrapper.c:1204
#2 0x557f1375073d in _php_stream_open_wrapper_ex /work/php-src/main/streams/streams.c:2270
#3 0x557f13478fa6 in zif_file_get_contents /work/php-src/ext/standard/file.c:409
#4 0x557f131bfe39 in zif_phar_file_get_contents /work/php-src/ext/phar/func_interceptors.c:226
#5 0x557f136b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#6 0x557f139e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#7 0x557f13b40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#8 0x557f13b558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#9 0x557f13cba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#10 0x557f136ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#11 0x557f136ecccb in php_execute_script /work/php-src/main/main.c:2685
#12 0x557f13cbfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#13 0x557f13cc21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#14 0x7f14599cd1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#15 0x7f14599cd28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#16 0x557f12809b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
Closes GH-21026.
* PHP-8.4: Fix crash in php_openssl_create_sni_server_ctx() when SSL_CTX_new() fails Fix crash in openssl_pkcs12_read() when BIO_new() fails Fix crash in openssl_pkey_export() when BIO_new() fails Fix crash in openssl_digest() when EVP_MD_CTX_create() fails
* PHP-8.5: Fix crash in php_openssl_create_sni_server_ctx() when SSL_CTX_new() fails Fix crash in openssl_pkcs12_read() when BIO_new() fails Fix crash in openssl_pkey_export() when BIO_new() fails Fix crash in openssl_digest() when EVP_MD_CTX_create() fails
`pkey` must be released after it was allocated on the error paths.
Otherwise we get leaks like this:
```
Direct leak of 32 byte(s) in 1 object(s) allocated from:
#0 0x7ff8d76a1340 in calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
#1 0x7ff8d7189136 in EVP_PKEY_new evp/p_lib.c:385
#2 0x7ff8d71178e4 in d2i_PrivateKey asn1/a_pkey.c:80
#3 0x7ff8d719ed07 in PEM_read_bio_PrivateKey pem/pem_pkey.c:135
#4 0x555c54726e80 in php_openssl_pem_read_bio_private_key /work/php-src/ext/openssl/openssl_backend_v1.c:738
#5 0x555c5471ee77 in php_openssl_pkey_from_zval /work/php-src/ext/openssl/openssl_backend_common.c:1297
#6 0x555c54712e3f in zif_openssl_open /work/php-src/ext/openssl/openssl.c:4331
#7 0x555c554b44e5 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#8 0x555c557dba0b in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2024
#9 0x555c5593cf57 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116514
#10 0x555c55951ec0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#11 0x555c55ab60cc in zend_execute_script /work/php-src/Zend/zend.c:1980
#12 0x555c554e8ecb in php_execute_script_ex /work/php-src/main/main.c:2645
#13 0x555c554e92db in php_execute_script /work/php-src/main/main.c:2685
#14 0x555c55abbc37 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#15 0x555c55abe204 in main /work/php-src/sapi/cli/php_cli.c:1362
#16 0x7ff8d6d061c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#17 0x7ff8d6d0628a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#18 0x555c54609db4 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609db4) (BuildId: 5cc444a6a9fc1a486ea698e72366c16bd5472605)
```
Closes GH-21054.
The file writes can have failed, but this error isn't visible for the application, fix it by propagating the error properly. Closes GH-21348.
When certificate `cert` exists, but is not added to the store, it causes
memory leaks. The error handling was already existing but the freeing
only happened on the success case.
One could also ponder whether it is necessary to inform the user when
adding a certificate failed or signal this in some way.
Part of the leak report:
```
Direct leak of 384 byte(s) in 1 object(s) allocated from:
#0 0x7fdbf1f9e9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x7fdbf183a7c4 in CRYPTO_zalloc (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2237c4) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#2 0x7fdbf16f9d13 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xe2d13) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#3 0x7fdbf16f9e19 in ASN1_item_new_ex (/lib/x86_64-linux-gnu/libcrypto.so.3+0xe2e19) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#4 0x7fdbf19a59f9 in X509_new_ex (/lib/x86_64-linux-gnu/libcrypto.so.3+0x38e9f9) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#5 0x5575bcd295cb in php_openssl_pem_read_bio_x509 /work/php-src/ext/openssl/openssl_backend_v3.c:876
#6 0x5575bcd2ef3d in php_openssl_load_stream_cafile /work/php-src/ext/openssl/xp_ssl.c:855
#7 0x5575bcd2f4da in php_openssl_enable_peer_verification /work/php-src/ext/openssl/xp_ssl.c:912
#8 0x5575bcd33104 in php_openssl_setup_crypto /work/php-src/ext/openssl/xp_ssl.c:1610
#9 0x5575bcd39c18 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2512
#10 0x5575bdb4c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#11 0x5575bdb5557d in php_stream_xport_crypto_setup /work/php-src/main/streams/transports.c:367
#12 0x5575bcd39f11 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2540
#13 0x5575bdb4c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#14 0x5575bdb54655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248
#15 0x5575bdb5365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145
#16 0x5575bd8d30b1 in php_stream_url_wrap_http_ex /work/php-src/ext/standard/http_fopen_wrapper.c:490
#17 0x5575bd8d857e in php_stream_url_wrap_http /work/php-src/ext/standard/http_fopen_wrapper.c:1204
#18 0x5575bdb5073d in _php_stream_open_wrapper_ex /work/php-src/main/streams/streams.c:2270
#19 0x5575bd878fa6 in zif_file_get_contents /work/php-src/ext/standard/file.c:409
#20 0x5575bd5bfe39 in zif_phar_file_get_contents /work/php-src/ext/phar/func_interceptors.c:226
#21 0x5575bdab7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#22 0x5575bdde024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#23 0x5575bdf40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#24 0x5575bdf558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#25 0x5575be0ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#26 0x5575bdaec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#27 0x5575bdaecccb in php_execute_script /work/php-src/main/main.c:2685
#28 0x5575be0bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#29 0x5575be0c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
... etc ...
```
Closes GH-21030.
* PHP-8.4: Fix memory leaks when adding certificate to store fails Fix missing error propagation in openssl_x509_export_to_file() Fix memory leak on error path in openssl_open()
* PHP-8.5: Fix memory leaks when adding certificate to store fails Fix missing error propagation in openssl_x509_export_to_file() Fix memory leak on error path in openssl_open()
It's possible there is no argon2 provider at all.
The file writes can have failed, but this error isn't visible for the application, fix it by propagating the error properly.
If the print fails, then the write is still executed, resulting in a partial export without any way of the user knowing this happened. Fix this by only returning true if all writes succeed.
The docs I found of this function appear to be wrong, as it can also return -1 on failure. See also openssl/openssl#29793 Closes GH-21047.
PEM_write_bio_PUBKEY() cannot handle a NULL argument:
```
==10779==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x7f426f79db69 bp 0x7fff0ec17940 sp 0x7fff0ec17928 T0)
==10779==The signal is caused by a WRITE memory access.
==10779==Hint: address points to the zero page.
#0 0x7f426f79db69 in BIO_up_ref (/lib/x86_64-linux-gnu/libcrypto.so.3+0xedb69) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#1 0x7f426f7a8ac2 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xf8ac2) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#2 0x7f426f87c6f0 (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1cc6f0) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#3 0x7f426f87caa6 in OSSL_ENCODER_to_bio (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1ccaa6) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#4 0x7f426f99dc5e in PEM_write_bio_PUBKEY (/lib/x86_64-linux-gnu/libcrypto.so.3+0x2edc5e) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#5 0x5637ebd00530 in zif_openssl_pkey_get_details /work/php-src/ext/openssl/openssl.c:2308
#6 0x5637ecab7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#7 0x5637ecde024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#8 0x5637ecf40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#9 0x5637ecf558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#10 0x5637ed0ba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#11 0x5637ecaec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#12 0x5637ecaecccb in php_execute_script /work/php-src/main/main.c:2685
#13 0x5637ed0bfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#14 0x5637ed0c21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#15 0x7f426f3321c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#16 0x7f426f33228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#17 0x5637ebc09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: eb0a8e6b6d683fbdf45156dfed4d76f9110252b9)
```
Closes GH-21015.
* PHP-8.4: Fix crash in openssl_pkey_get_details() when BIO_new() fails Fix error check on X509V3_EXT_print()
* PHP-8.5: Fix crash in openssl_pkey_get_details() when BIO_new() fails Fix error check on X509V3_EXT_print()
This function returns -1 on failure. Not checking this causes a segfault
if `cert_name` is still NULL, i.e. if the failure happens on the first
iteration. If the failure happens on the second iteration, we get a
use-after-free.
NULL deref example:
```
==189347==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f961f6f379d bp 0x7ffdc44afed0 sp 0x7ffdc44af658 T0)
==189347==The signal is caused by a READ memory access.
==189347==Hint: address points to the zero page.
#0 0x7f961f6f379d (/lib/x86_64-linux-gnu/libc.so.6+0x18b79d) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#1 0x7f9620217826 in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:389
#2 0x560faa92d119 in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:478
#3 0x560faa92e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636
#4 0x560faa93565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893
#5 0x560faa939c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516
#6 0x560fab74c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#7 0x560fab7557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387
#8 0x560faa939f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541
#9 0x560fab74c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#10 0x560fab754655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248
#11 0x560fab75365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145
#12 0x560fab54d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158
#13 0x560fab6b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#14 0x560fab9e024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#15 0x560fabb40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#16 0x560fabb558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#17 0x560fabcba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#18 0x560fab6ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#19 0x560fab6ecccb in php_execute_script /work/php-src/main/main.c:2685
#20 0x560fabcbfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#21 0x560fabcc21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#22 0x7f961f5921c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#23 0x7f961f59228a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#24 0x560faa809b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
UAF example:
```
==190632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5020000690f0 at pc 0x7fc2cdb3596f bp 0x7ffce2ed98d0 sp 0x7ffce2ed9078
READ of size 3 at 0x5020000690f0 thread T0
#0 0x7fc2cdb3596e in strlen ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:391
#1 0x558b6eb2d119 in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:478
#2 0x558b6eb2e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636
#3 0x558b6eb3565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893
#4 0x558b6eb39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516
#5 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#6 0x558b6f9557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387
#7 0x558b6eb39f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541
#8 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#9 0x558b6f954655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248
#10 0x558b6f95365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145
#11 0x558b6f74d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158
#12 0x558b6f8b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#13 0x558b6fbe024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#14 0x558b6fd40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#15 0x558b6fd558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#16 0x558b6feba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#17 0x558b6f8ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#18 0x558b6f8ecccb in php_execute_script /work/php-src/main/main.c:2685
#19 0x558b6febfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#20 0x558b6fec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#21 0x7fc2cceb01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#22 0x7fc2cceb028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#23 0x558b6ea09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
0x5020000690f0 is located 0 bytes inside of 9-byte region [0x5020000690f0,0x5020000690f9)
freed by thread T0 here:
#0 0x7fc2cdbb44d8 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x558b6eb2d2fa in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:496
#2 0x558b6eb2e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636
#3 0x558b6eb3565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893
#4 0x558b6eb39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516
#5 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#6 0x558b6f9557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387
#7 0x558b6eb39f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541
#8 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#9 0x558b6f954655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248
#10 0x558b6f95365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145
#11 0x558b6f74d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158
#12 0x558b6f8b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#13 0x558b6fbe024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#14 0x558b6fd40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#15 0x558b6fd558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#16 0x558b6feba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#17 0x558b6f8ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#18 0x558b6f8ecccb in php_execute_script /work/php-src/main/main.c:2685
#19 0x558b6febfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#20 0x558b6fec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#21 0x7fc2cceb01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#22 0x7fc2cceb028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#23 0x558b6ea09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
previously allocated by thread T0 here:
#0 0x7fc2cdbb59c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x7fc2cd2faeab in ASN1_mbstring_ncopy (/lib/x86_64-linux-gnu/libcrypto.so.3+0xcceab) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#2 0x7fc2cd2fb2e5 in ASN1_mbstring_copy (/lib/x86_64-linux-gnu/libcrypto.so.3+0xcd2e5) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#3 0x7fc2cd2fe2a5 in ASN1_STRING_to_UTF8 (/lib/x86_64-linux-gnu/libcrypto.so.3+0xd02a5) (BuildId: 0698e1ff610cb3c6993dccbd82c1281b1b4c5ade)
#4 0x558b6eb2d0a8 in php_openssl_matches_san_list /work/php-src/ext/openssl/xp_ssl.c:477
#5 0x558b6eb2e912 in php_openssl_apply_peer_verification_policy /work/php-src/ext/openssl/xp_ssl.c:636
#6 0x558b6eb3565b in php_openssl_enable_crypto /work/php-src/ext/openssl/xp_ssl.c:1893
#7 0x558b6eb39c86 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2516
#8 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#9 0x558b6f9557c1 in php_stream_xport_crypto_enable /work/php-src/main/streams/transports.c:387
#10 0x558b6eb39f29 in php_openssl_sockop_set_option /work/php-src/ext/openssl/xp_ssl.c:2541
#11 0x558b6f94c610 in _php_stream_set_option /work/php-src/main/streams/streams.c:1466
#12 0x558b6f954655 in php_stream_xport_connect /work/php-src/main/streams/transports.c:248
#13 0x558b6f95365d in _php_stream_xport_create /work/php-src/main/streams/transports.c:145
#14 0x558b6f74d725 in zif_stream_socket_client /work/php-src/ext/standard/streamsfuncs.c:158
#15 0x558b6f8b7ed2 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306
#16 0x558b6fbe024a in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154
#17 0x558b6fd40995 in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519
#18 0x558b6fd558b0 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962
#19 0x558b6feba0ab in zend_execute_script /work/php-src/Zend/zend.c:1980
#20 0x558b6f8ec8bb in php_execute_script_ex /work/php-src/main/main.c:2645
#21 0x558b6f8ecccb in php_execute_script /work/php-src/main/main.c:2685
#22 0x558b6febfc16 in do_cli /work/php-src/sapi/cli/php_cli.c:951
#23 0x558b6fec21e3 in main /work/php-src/sapi/cli/php_cli.c:1362
#24 0x7fc2cceb01c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#25 0x7fc2cceb028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#26 0x558b6ea09b34 in _start (/work/php-src/build-dbg-asan/sapi/cli/php+0x609b34) (BuildId: aa149f943514fff0c491e1f199e30fed0e977f7c)
```
Closes GH-21017.
This call can fail but this is not checked. The other setter call is checked however. Closes GH-21028.
* PHP-8.4: Fix error check on X509_set_subject_name() Fix crash when ASN1_STRING_to_UTF8() fails
* PHP-8.5: Fix error check on X509_set_subject_name() Fix crash when ASN1_STRING_to_UTF8() fails
It changes the SNI tests to use certificate generator like other TLS tests. Closes GH-21628
* PHP-8.2: Fix GH-21617: sni_server self signed certifcate expired
* PHP-8.3: Fix SNI tests for bugs #80770 and #74796 Fix GH-21617: sni_server self signed certifcate expired
* PHP-8.4: Add back sni_server_ca for expired cert test Fix SNI tests for bugs #80770 and #74796 Fix GH-21617: sni_server self signed certifcate expired
* PHP-8.5: Add back sni_server_ca for expired cert test Fix SNI tests for bugs #80770 and #74796 Fix GH-21617: sni_server self signed certifcate expired
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )