Skip to content

Commit 08aab82

Browse files
GirgiasGirgias
committed
Promote various OpenSSL warnings into Errors
1 parent 26171c3 commit 08aab82

32 files changed

+802
-481
lines changed

‎ext/openssl/openssl.c

+165-151
Large diffs are not rendered by default.

‎ext/openssl/openssl.stub.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ function openssl_encrypt(string $data, string $method, string $password, int $op
194194

195195
function openssl_decrypt(string $data, string $method, string $password, int $options = 0, string $iv = '', string $tag = UNKNOWN, string $aad = ''): string|false {}
196196

197-
function openssl_cipher_iv_length(string $method): int|false {}
197+
function openssl_cipher_iv_length(string $method): int {}
198198

199199
/** @param resource $dh_key */
200200
function openssl_dh_compute_key(string $pub_key, $dh_key): string|false {}

‎ext/openssl/openssl_arginfo.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -325,7 +325,7 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_openssl_decrypt, 0, 3, MAY_BE_ST
325325
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, aad, IS_STRING, 0, "\'\'")
326326
ZEND_END_ARG_INFO()
327327

328-
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_openssl_cipher_iv_length, 0, 1, MAY_BE_LONG|MAY_BE_FALSE)
328+
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_openssl_cipher_iv_length, 0, 1, IS_LONG, 0)
329329
ZEND_ARG_TYPE_INFO(0, method, IS_STRING, 0)
330330
ZEND_END_ARG_INFO()
331331

‎ext/openssl/tests/bug38255.phpt

+20-14
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,12 @@ if (!extension_loaded("openssl")) die("skip");
88
<?php
99
$pub_key_id = false;
1010
$signature = '';
11-
$ok = openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5);
11+
12+
try {
13+
$ok = openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5);
14+
} catch (\TypeError $e) {
15+
echo $e->getMessage() . \PHP_EOL;
16+
}
1217

1318
class test {
1419
function __toString() {
@@ -18,18 +23,19 @@ class test {
1823
$t = new test;
1924

2025

21-
var_dump(openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5));
22-
var_dump(openssl_verify("foo", $t, $pub_key_id, OPENSSL_ALGO_MD5));
23-
24-
echo "Done\n";
26+
try {
27+
var_dump(openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5));
28+
} catch (\TypeError $e) {
29+
echo $e->getMessage() . \PHP_EOL;
30+
}
31+
try {
32+
var_dump(openssl_verify("foo", $t, $pub_key_id, OPENSSL_ALGO_MD5));
33+
} catch (\TypeError $e) {
34+
echo $e->getMessage() . \PHP_EOL;
35+
}
2536

2637
?>
27-
--EXPECTF--
28-
Warning: openssl_verify(): Supplied key param cannot be coerced into a public key in %s on line %d
29-
30-
Warning: openssl_verify(): Supplied key param cannot be coerced into a public key in %s on line %d
31-
bool(false)
32-
33-
Warning: openssl_verify(): Supplied key param cannot be coerced into a public key in %s on line %d
34-
bool(false)
35-
Done
38+
--EXPECT--
39+
openssl_verify(): Argument #3 ($key) cannot be coerced into a public key
40+
openssl_verify(): Argument #3 ($key) cannot be coerced into a public key
41+
openssl_verify(): Argument #3 ($key) cannot be coerced into a public key

‎ext/openssl/tests/bug38261.phpt

+27-11
Original file line numberDiff line numberDiff line change
@@ -14,20 +14,36 @@ class test {
1414
}
1515
$t = new test;
1616

17-
var_dump(openssl_x509_parse("foo"));
18-
var_dump(openssl_x509_parse($t));
19-
var_dump(openssl_x509_parse(array()));
20-
var_dump(openssl_x509_parse($cert));
17+
try {
18+
var_dump(openssl_x509_parse("foo"));
19+
} catch (\TypeError $e) {
20+
echo $e->getMessage() . \PHP_EOL;
21+
}
22+
try {
23+
var_dump(openssl_x509_parse($t));
24+
} catch (\TypeError $e) {
25+
echo $e->getMessage() . \PHP_EOL;
26+
}
27+
try {
28+
var_dump(openssl_x509_parse(array()));
29+
} catch (\TypeError $e) {
30+
echo $e->getMessage() . \PHP_EOL;
31+
}
32+
try {
33+
var_dump(openssl_x509_parse($cert));
34+
} catch (\TypeError $e) {
35+
echo $e->getMessage() . \PHP_EOL;
36+
}
2137
try {
2238
var_dump(openssl_x509_parse(new stdClass));
2339
} catch (Error $e) {
24-
echo $e->getMessage(), "\n";
40+
echo get_class($e) . ': ' . $e->getMessage() . \PHP_EOL;
2541
}
2642

2743
?>
28-
--EXPECTF--
29-
bool(false)
30-
bool(false)
31-
bool(false)
32-
bool(false)
33-
Object of class stdClass could not be converted to string
44+
--EXPECT--
45+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
46+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
47+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
48+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
49+
Error: Object of class stdClass could not be converted to string

‎ext/openssl/tests/bug60632.phpt

+8-5
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@ $test_pubkey = $details['key'];
1919
$pubkey = openssl_pkey_get_public($test_pubkey);
2020
$encrypted = null;
2121
$ekeys = array();
22-
$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CBC');
23-
echo "Done";
22+
23+
try {
24+
$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CBC');
25+
} catch (\ValueError $e) {
26+
echo $e->getMessage() . \PHP_EOL;
27+
}
2428
?>
25-
--EXPECTF--
26-
Warning: openssl_seal(): Cipher algorithm requires an IV to be supplied as a sixth parameter in %s on line %d
27-
Done
29+
--EXPECT--
30+
openssl_seal(): Argument #6 ($iv) must provide an IV for chosen cipher algorithm

‎ext/openssl/tests/bug70438.phpt

+14-6
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,22 @@ $cipher = 'AES-128-CBC';
1414
$pub_key = "file://" . __DIR__ . "/public.key";
1515
$priv_key = "file://" . __DIR__ . "/private_rsa_1024.key";
1616

17-
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), $cipher);
18-
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), 'sparkles', $iv);
17+
try {
18+
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), $cipher);
19+
} catch (\ValueError $e) {
20+
echo $e->getMessage() . \PHP_EOL;
21+
}
22+
try {
23+
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), 'sparkles', $iv);
24+
} catch (\ValueError $e) {
25+
echo $e->getMessage() . \PHP_EOL;
26+
}
27+
1928
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), $cipher, $iv);
2029
openssl_open($sealed, $decrypted, $ekeys[0], $priv_key, $cipher, $iv);
2130
echo $decrypted;
2231
?>
23-
--EXPECTF--
24-
Warning: openssl_seal(): Cipher algorithm requires an IV to be supplied as a sixth parameter in %s on line %d
25-
26-
Warning: openssl_seal(): Unknown signature algorithm. in %s on line %d
32+
--EXPECT--
33+
openssl_seal(): Argument #6 ($iv) must provide an IV for chosen cipher algorithm
34+
openssl_seal(): Argument #5 ($method) must be a valid signature algorithm
2735
openssl_seal() test

‎ext/openssl/tests/cve-2013-6420.phpt

+12-8
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,16 @@ CVE-2013-6420
55
--FILE--
66
<?php
77
$crt = substr(__FILE__, 0, -4).'.crt';
8-
$info = openssl_x509_parse("file://$crt");
9-
var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
8+
9+
try {
10+
$info = openssl_x509_parse("file://$crt");
11+
} catch (\ValueError $e) {
12+
echo $e->getMessage() . \PHP_EOL;
13+
}
14+
15+
@var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
1016
?>
11-
Done
12-
--EXPECTF--
13-
%s openssl_x509_parse(): Illegal length in timestamp in %s%ecve-2013-6420.php on line 3
14-
string(27) "[email protected]"
15-
int(-1)
16-
Done
17+
--EXPECT--
18+
Illegal length in timestamp
19+
NULL
20+
NULL

‎ext/openssl/tests/ecc.phpt

+7-5
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,12 @@ $argsFailed = array(
1717
"private_key_type" => OPENSSL_KEYTYPE_EC,
1818
);
1919

20-
$keyFailed = openssl_pkey_new($argsFailed);
21-
var_dump($keyFailed);
20+
try {
21+
$keyFailed = openssl_pkey_new($argsFailed);
22+
var_dump($keyFailed);
23+
} catch (\ValueError $e) {
24+
echo $e->getMessage() . \PHP_EOL;
25+
}
2226

2327
$d1 = openssl_pkey_get_details($key1);
2428
var_dump($d1["bits"]);
@@ -82,9 +86,7 @@ foreach ($curve_names as $curve_name) {
8286
--EXPECTF--
8387
Testing openssl_pkey_new
8488
resource(%d) of type (OpenSSL key)
85-
86-
Warning: openssl_pkey_new(): Unknown elliptic curve (short) name invalid_cuve_name in %s on line %d
87-
bool(false)
89+
Unknown elliptic curve (short) name invalid_cuve_name
8890
int(384)
8991
int(215)
9092
string(9) "secp384r1"

‎ext/openssl/tests/openssl_csr_new_basic.phpt

+8-7
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ openssl_csr_new() tests
88
$a = array();
99

1010
$conf = array('config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf');
11-
var_dump(openssl_csr_new(array(), $a, $conf, array()));
11+
12+
try {
13+
var_dump(openssl_csr_new(array(), $a, $conf, array()));
14+
var_dump($keyFailed);
15+
} catch (\ValueError $e) {
16+
echo $e->getMessage() . \PHP_EOL;
17+
}
1218

1319
// this leaks
1420
$a = array(1,2);
@@ -19,14 +25,9 @@ var_dump(openssl_csr_new($a, $b, $conf));
1925
$x = openssl_pkey_new($conf);
2026
var_dump(openssl_csr_new(["countryName" => "DE"], $x, $conf + ["x509_extensions" => 0xDEADBEEF]));
2127

22-
23-
echo "Done\n";
2428
?>
2529
--EXPECTF--
26-
Warning: openssl_csr_new(): Key array must be of the form array(0 => key, 1 => phrase) in %s on line %d
27-
2830
Warning: openssl_csr_new(): add1_attr_by_txt challengePassword_min -> 4 (failed; check error queue and value of string_mask OpenSSL option if illegal characters are reported) in %s on line %d
29-
bool(false)
31+
Key array must be of the form array(0 => key, 1 => phrase)
3032
resource(%d) of type (OpenSSL X.509 CSR)
3133
resource(%d) of type (OpenSSL X.509 CSR)
32-
Done

‎ext/openssl/tests/openssl_csr_sign_basic.phpt

+42-23
Original file line numberDiff line numberDiff line change
@@ -33,37 +33,56 @@ var_dump(openssl_csr_sign($csr, null, $privkey, 365, $args));
3333
var_dump(openssl_csr_sign($csr, null, $privkey, 365, $config_arg));
3434
var_dump(openssl_csr_sign($csr, $cert, $priv, 365, $config_arg));
3535
var_dump(openssl_csr_sign($csr, openssl_x509_read($cert), $priv, 365, $config_arg));
36-
var_dump(openssl_csr_sign($csr, $wrong, $privkey, 365));
37-
var_dump(openssl_csr_sign($csr, null, $wrong, 365));
38-
var_dump(openssl_csr_sign($wrong, null, $privkey, 365));
39-
var_dump(openssl_csr_sign(array(), null, $privkey, 365));
40-
var_dump(openssl_csr_sign($csr, array(), $privkey, 365));
41-
var_dump(openssl_csr_sign($csr, null, array(), 365));
36+
37+
try {
38+
var_dump(openssl_csr_sign($csr, $wrong, $privkey, 365));
39+
} catch (\TypeError $e) {
40+
echo $e->getMessage() . \PHP_EOL;
41+
}
42+
43+
try {
44+
var_dump(openssl_csr_sign($csr, null, $wrong, 365));
45+
} catch (\TypeError $e) {
46+
echo $e->getMessage() . \PHP_EOL;
47+
}
48+
49+
try {
50+
var_dump(openssl_csr_sign($wrong, null, $privkey, 365));
51+
} catch (\TypeError $e) {
52+
echo $e->getMessage() . \PHP_EOL;
53+
}
54+
55+
try {
56+
var_dump(openssl_csr_sign(array(), null, $privkey, 365));
57+
} catch (\TypeError $e) {
58+
echo $e->getMessage() . \PHP_EOL;
59+
}
60+
61+
try {
62+
var_dump(openssl_csr_sign($csr, array(), $privkey, 365));
63+
} catch (\TypeError $e) {
64+
echo $e->getMessage() . \PHP_EOL;
65+
}
66+
67+
try {
68+
var_dump(openssl_csr_sign($csr, null, array(), 365));
69+
} catch (\ValueError $e) {
70+
echo $e->getMessage() . \PHP_EOL;
71+
}
72+
4273
var_dump(openssl_csr_sign($csr, null, $privkey, 365, $config_arg));
4374
?>
4475
--EXPECTF--
4576
resource(%d) of type (OpenSSL X.509)
4677
resource(%d) of type (OpenSSL X.509)
4778
resource(%d) of type (OpenSSL X.509)
4879
resource(%d) of type (OpenSSL X.509)
49-
50-
Warning: openssl_csr_sign(): Cannot get cert from parameter 2 in %s on line %d
51-
bool(false)
52-
53-
Warning: openssl_csr_sign(): Cannot get private key from parameter 3 in %s on line %d
54-
bool(false)
55-
56-
Warning: openssl_csr_sign(): Cannot get CSR from parameter 1 in %s on line %d
57-
bool(false)
58-
59-
Warning: openssl_csr_sign(): Cannot get CSR from parameter 1 in %s on line %d
60-
bool(false)
61-
62-
Warning: openssl_csr_sign(): Cannot get cert from parameter 2 in %s on line %d
63-
bool(false)
64-
65-
Warning: openssl_csr_sign(): Key array must be of the form array(0 => key, 1 => phrase) in %s on line %d
80+
openssl_csr_sign(): Argument #2 ($cacert) cannot be coerced into an X509 certificate
6681

6782
Warning: openssl_csr_sign(): Cannot get private key from parameter 3 in %s on line %d
6883
bool(false)
84+
openssl_csr_sign(): Argument #1 ($csr) cannot be coerced into a Certificate Signing Request (CSR)
85+
openssl_csr_sign(): Argument #1 ($csr) cannot be coerced into a Certificate Signing Request (CSR)
86+
openssl_csr_sign(): Argument #2 ($cacert) cannot be coerced into an X509 certificate
87+
Key array must be of the form array(0 => key, 1 => phrase)
6988
resource(%d) of type (OpenSSL X.509)

‎ext/openssl/tests/openssl_decrypt_error.phpt

+29-16
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,34 @@ $iv = str_repeat("\0", openssl_cipher_iv_length($method));
1212

1313
$encrypted = openssl_encrypt($data, $method, $password);
1414
var_dump($encrypted); /* Not passing $iv should be the same as all-NULL iv, but with a warning */
15+
1516
var_dump(openssl_encrypt($data, $method, $password, 0, $iv));
17+
1618
var_dump(openssl_decrypt($encrypted, $method, $wrong));
17-
var_dump(openssl_decrypt($encrypted, $wrong, $password));
19+
20+
try {
21+
var_dump(openssl_decrypt($encrypted, $wrong, $password));
22+
} catch (\ValueError $e) {
23+
echo $e->getMessage() . \PHP_EOL;
24+
}
25+
1826
var_dump(openssl_decrypt($wrong, $method, $password));
19-
var_dump(openssl_decrypt($wrong, $wrong, $password));
20-
var_dump(openssl_decrypt($encrypted, $wrong, $wrong));
21-
var_dump(openssl_decrypt($wrong, $wrong, $wrong));
27+
28+
try {
29+
var_dump(openssl_decrypt($wrong, $wrong, $password));
30+
} catch (\ValueError $e) {
31+
echo $e->getMessage() . \PHP_EOL;
32+
}
33+
try {
34+
var_dump(openssl_decrypt($encrypted, $wrong, $wrong));
35+
} catch (\ValueError $e) {
36+
echo $e->getMessage() . \PHP_EOL;
37+
}
38+
try {
39+
var_dump(openssl_decrypt($wrong, $wrong, $wrong));
40+
} catch (\ValueError $e) {
41+
echo $e->getMessage() . \PHP_EOL;
42+
}
2243

2344
// invalid using of an authentication tag
2445
var_dump(openssl_encrypt($data, $method, $password, 0, $iv, $wrong));
@@ -28,19 +49,11 @@ Warning: openssl_encrypt(): Using an empty Initialization Vector (iv) is potenti
2849
string(44) "yof6cPPH4mLee6TOc0YQSrh4dvywMqxGUyjp0lV6+aM="
2950
string(44) "yof6cPPH4mLee6TOc0YQSrh4dvywMqxGUyjp0lV6+aM="
3051
bool(false)
31-
32-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
33-
bool(false)
34-
bool(false)
35-
36-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
37-
bool(false)
38-
39-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
40-
bool(false)
41-
42-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
52+
Unknown cipher algorithm
4353
bool(false)
54+
Unknown cipher algorithm
55+
Unknown cipher algorithm
56+
Unknown cipher algorithm
4457

4558
Warning: openssl_encrypt(): The authenticated tag cannot be provided for cipher that doesn not support AEAD in %s on line %d
4659
string(44) "yof6cPPH4mLee6TOc0YQSrh4dvywMqxGUyjp0lV6+aM="

0 commit comments

Comments
 (0)