Skip to content

Commit 1ea3f53

Browse files
GirgiasGirgias
committed
Promote various OpenSSL warnings into Errors
1 parent a6e3ce4 commit 1ea3f53

35 files changed

+764
-459
lines changed

‎ext/openssl/openssl.c

+160-146
Large diffs are not rendered by default.

‎ext/openssl/openssl.stub.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ function openssl_encrypt(string $data, string $method, string $password, int $op
204204

205205
function openssl_decrypt(string $data, string $method, string $password, int $options = 0, string $iv = '', string $tag = UNKNOWN, string $aad = ''): string|false {}
206206

207-
function openssl_cipher_iv_length(string $method): int|false {}
207+
function openssl_cipher_iv_length(string $method): int {}
208208

209209
function openssl_dh_compute_key(string $pub_key, OpenSSLAsymmetricKey $dh_key): string|false {}
210210

‎ext/openssl/openssl_arginfo.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This is a generated file, edit the .stub.php file instead.
2-
* Stub hash: ed45da0e8786db9b20fd33d574b20f3d41304e0a */
2+
* Stub hash: 2b91efa4238630826cc61cd4afe996e31a647a55 */
33

44
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_openssl_x509_export_to_file, 0, 2, _IS_BOOL, 0)
55
ZEND_ARG_OBJ_TYPE_MASK(0, x509, OpenSSLCertificate, MAY_BE_STRING, NULL)
@@ -328,7 +328,7 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_openssl_decrypt, 0, 3, MAY_BE_ST
328328
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, aad, IS_STRING, 0, "\'\'")
329329
ZEND_END_ARG_INFO()
330330

331-
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_openssl_cipher_iv_length, 0, 1, MAY_BE_LONG|MAY_BE_FALSE)
331+
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_openssl_cipher_iv_length, 0, 1, IS_LONG, 0)
332332
ZEND_ARG_TYPE_INFO(0, method, IS_STRING, 0)
333333
ZEND_END_ARG_INFO()
334334

‎ext/openssl/tests/bug38255.phpt

+20-14
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,12 @@ if (!extension_loaded("openssl")) die("skip");
88
<?php
99
$pub_key_id = false;
1010
$signature = '';
11-
$ok = openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5);
11+
12+
try {
13+
$ok = openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5);
14+
} catch (\TypeError $e) {
15+
echo $e->getMessage() . \PHP_EOL;
16+
}
1217

1318
class test {
1419
function __toString() {
@@ -18,18 +23,19 @@ class test {
1823
$t = new test;
1924

2025

21-
var_dump(openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5));
22-
var_dump(openssl_verify("foo", $t, $pub_key_id, OPENSSL_ALGO_MD5));
23-
24-
echo "Done\n";
26+
try {
27+
var_dump(openssl_verify("foo", $signature, $pub_key_id, OPENSSL_ALGO_MD5));
28+
} catch (\TypeError $e) {
29+
echo $e->getMessage() . \PHP_EOL;
30+
}
31+
try {
32+
var_dump(openssl_verify("foo", $t, $pub_key_id, OPENSSL_ALGO_MD5));
33+
} catch (\TypeError $e) {
34+
echo $e->getMessage() . \PHP_EOL;
35+
}
2536

2637
?>
27-
--EXPECTF--
28-
Warning: openssl_verify(): Supplied key param cannot be coerced into a public key in %s on line %d
29-
30-
Warning: openssl_verify(): Supplied key param cannot be coerced into a public key in %s on line %d
31-
bool(false)
32-
33-
Warning: openssl_verify(): Supplied key param cannot be coerced into a public key in %s on line %d
34-
bool(false)
35-
Done
38+
--EXPECT--
39+
openssl_verify(): Argument #3 ($key) cannot be coerced into a public key
40+
openssl_verify(): Argument #3 ($key) cannot be coerced into a public key
41+
openssl_verify(): Argument #3 ($key) cannot be coerced into a public key

‎ext/openssl/tests/bug38261.phpt

+13-5
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,11 @@ class test {
1414
}
1515
$t = new test;
1616

17-
var_dump(openssl_x509_parse("foo"));
17+
try {
18+
var_dump(openssl_x509_parse("foo"));
19+
} catch (TypeError $e) {
20+
echo $e->getMessage(), "\n";
21+
}
1822

1923
try {
2024
var_dump(openssl_x509_parse($t));
@@ -28,7 +32,11 @@ try {
2832
echo $e->getMessage(), "\n";
2933
}
3034

31-
var_dump(openssl_x509_parse($cert));
35+
try {
36+
var_dump(openssl_x509_parse($cert));
37+
} catch (TypeError $e) {
38+
echo $e->getMessage(), "\n";
39+
}
3240

3341
try {
3442
openssl_x509_parse(new stdClass);
@@ -38,8 +46,8 @@ try {
3846

3947
?>
4048
--EXPECT--
41-
bool(false)
42-
bool(false)
49+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
50+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
4351
openssl_x509_parse(): Argument #1 ($x509) must be of type OpenSSLCertificate|string, array given
44-
bool(false)
52+
openssl_x509_parse(): Argument #1 ($x509) cannot be coerced into an X509 certificate
4553
openssl_x509_parse(): Argument #1 ($x509) must be of type OpenSSLCertificate|string, stdClass given

‎ext/openssl/tests/bug60632.phpt

+8-5
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,12 @@ $test_pubkey = $details['key'];
1919
$pubkey = openssl_pkey_get_public($test_pubkey);
2020
$encrypted = null;
2121
$ekeys = array();
22-
$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CBC');
23-
echo "Done";
22+
23+
try {
24+
$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CBC');
25+
} catch (\ValueError $e) {
26+
echo $e->getMessage() . \PHP_EOL;
27+
}
2428
?>
25-
--EXPECTF--
26-
Warning: openssl_seal(): Cipher algorithm requires an IV to be supplied as a sixth parameter in %s on line %d
27-
Done
29+
--EXPECT--
30+
openssl_seal(): Argument #6 ($iv) must provide an IV for chosen cipher algorithm

‎ext/openssl/tests/bug70438.phpt

+14-6
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,22 @@ $cipher = 'AES-128-CBC';
1414
$pub_key = "file://" . __DIR__ . "/public.key";
1515
$priv_key = "file://" . __DIR__ . "/private_rsa_1024.key";
1616

17-
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), $cipher);
18-
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), 'sparkles', $iv);
17+
try {
18+
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), $cipher);
19+
} catch (\ValueError $e) {
20+
echo $e->getMessage() . \PHP_EOL;
21+
}
22+
try {
23+
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), 'sparkles', $iv);
24+
} catch (\ValueError $e) {
25+
echo $e->getMessage() . \PHP_EOL;
26+
}
27+
1928
openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key), $cipher, $iv);
2029
openssl_open($sealed, $decrypted, $ekeys[0], $priv_key, $cipher, $iv);
2130
echo $decrypted;
2231
?>
23-
--EXPECTF--
24-
Warning: openssl_seal(): Cipher algorithm requires an IV to be supplied as a sixth parameter in %s on line %d
25-
26-
Warning: openssl_seal(): Unknown signature algorithm. in %s on line %d
32+
--EXPECT--
33+
openssl_seal(): Argument #6 ($iv) must provide an IV for chosen cipher algorithm
34+
openssl_seal(): Argument #5 ($method) must be a valid signature algorithm
2735
openssl_seal() test

‎ext/openssl/tests/cve-2013-6420.phpt

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ CVE-2013-6420
55
--FILE--
66
<?php
77
$crt = substr(__FILE__, 0, -4).'.crt';
8+
89
$info = openssl_x509_parse("file://$crt");
10+
911
var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
1012
?>
11-
Done
1213
--EXPECTF--
13-
%s openssl_x509_parse(): Illegal length in timestamp in %s%ecve-2013-6420.php on line 3
14+
Warning: openssl_x509_parse(): Illegal length in timestamp in %s on line %d
1415
string(27) "[email protected]"
1516
int(-1)
16-
Done

‎ext/openssl/tests/ecc.phpt

+6-2
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,12 @@ $argsFailed = array(
1717
"private_key_type" => OPENSSL_KEYTYPE_EC,
1818
);
1919

20-
$keyFailed = openssl_pkey_new($argsFailed);
21-
var_dump($keyFailed);
20+
try {
21+
$keyFailed = openssl_pkey_new($argsFailed);
22+
var_dump($keyFailed);
23+
} catch (\ValueError $e) {
24+
echo $e->getMessage() . \PHP_EOL;
25+
}
2226

2327
$d1 = openssl_pkey_get_details($key1);
2428
var_dump($d1["bits"]);

‎ext/openssl/tests/openssl_csr_export_basic.phpt

+2-4
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,8 @@ try {
3939
}
4040
var_dump(openssl_csr_export($csr, $output, false));
4141
?>
42-
--EXPECTF--
42+
--EXPECT--
4343
bool(true)
44-
45-
Warning: openssl_csr_export(): X.509 Certificate Signing Request cannot be retrieved in %s on line %d
46-
bool(false)
44+
openssl_csr_export(): Argument #1 ($csr) X.509 Certificate Signing Request cannot be retrieved
4745
openssl_csr_export(): Argument #1 ($csr) must be of type OpenSSLCertificateSigningRequest|string, OpenSSLAsymmetricKey given
4846
bool(true)

‎ext/openssl/tests/openssl_csr_export_to_file_basic.phpt

+6-4
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,11 @@ $csr = openssl_csr_new($dn, $privkey_file, $args);
3737
var_dump(openssl_csr_export_to_file($csr, $csrfile));
3838
var_dump(file_get_contents($csrfile));
3939

40-
var_dump(openssl_csr_export_to_file($wrong, $csrfile));
40+
try {
41+
var_dump(openssl_csr_export_to_file($wrong, $csrfile));
42+
} catch (TypeError $e) {
43+
echo $e->getMessage(), "\n";
44+
}
4145

4246
try {
4347
openssl_csr_export_to_file($dh, $csrfile);
@@ -74,8 +78,6 @@ sfBgVeqg0P4SWez5fHXqBNcjMdMI5f0bikcDZSIfTHS8FX+PMurLBC8UPB0YNIOl
7478
JViHkCA9x6m8RJXAFvqmgLlWlUzbDv/cRrDfjWjR
7579
-----END CERTIFICATE REQUEST-----
7680
"
77-
78-
Warning: openssl_csr_export_to_file(): X.509 Certificate Signing Request cannot be retrieved in %s on line %d
79-
bool(false)
81+
openssl_csr_export_to_file(): Argument #1 ($csr) X.509 Certificate Signing Request cannot be retrieved
8082
openssl_csr_export_to_file(): Argument #1 ($csr) must be of type OpenSSLCertificateSigningRequest|string, OpenSSLAsymmetricKey given
8183
bool(true)

‎ext/openssl/tests/openssl_csr_new_basic.phpt

+8-7
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ openssl_csr_new() tests
88
$a = array();
99

1010
$conf = array('config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf');
11-
var_dump(openssl_csr_new(array(), $a, $conf, array()));
11+
12+
try {
13+
var_dump(openssl_csr_new(array(), $a, $conf, array()));
14+
var_dump($keyFailed);
15+
} catch (\ValueError $e) {
16+
echo $e->getMessage() . \PHP_EOL;
17+
}
1218

1319
// this leaks
1420
$a = array(1,2);
@@ -19,16 +25,11 @@ var_dump(openssl_csr_new($a, $b, $conf));
1925
$x = openssl_pkey_new($conf);
2026
var_dump(openssl_csr_new(["countryName" => "DE"], $x, $conf + ["x509_extensions" => 0xDEADBEEF]));
2127

22-
23-
echo "Done\n";
2428
?>
2529
--EXPECTF--
26-
Warning: openssl_csr_new(): Key array must be of the form array(0 => key, 1 => phrase) in %s on line %d
27-
2830
Warning: openssl_csr_new(): add1_attr_by_txt challengePassword_min -> 4 (failed; check error queue and value of string_mask OpenSSL option if illegal characters are reported) in %s on line %d
29-
bool(false)
31+
Key array must be of the form array(0 => key, 1 => phrase)
3032
object(OpenSSLCertificateSigningRequest)#%d (0) {
3133
}
3234
object(OpenSSLCertificateSigningRequest)#%d (0) {
3335
}
34-
Done

‎ext/openssl/tests/openssl_csr_sign_basic.phpt

+31-20
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,24 @@ var_dump(openssl_csr_sign($csr, null, $privkey, 365, $args));
3434
var_dump(openssl_csr_sign($csr, null, $privkey, 365, $config_arg));
3535
var_dump(openssl_csr_sign($csr, $cert, $priv, 365, $config_arg));
3636
var_dump(openssl_csr_sign($csr, openssl_x509_read($cert), $priv, 365, $config_arg));
37-
var_dump(openssl_csr_sign($csr, $wrong, $privkey, 365));
38-
var_dump(openssl_csr_sign($csr, null, $wrong, 365));
39-
var_dump(openssl_csr_sign($wrong, null, $privkey, 365));
37+
38+
try {
39+
var_dump(openssl_csr_sign($csr, $wrong, $privkey, 365));
40+
} catch (TypeError $exception) {
41+
echo $exception->getMessage() . "\n";
42+
}
43+
44+
try {
45+
var_dump(openssl_csr_sign($csr, null, $wrong, 365));
46+
} catch (TypeError $exception) {
47+
echo $exception->getMessage() . "\n";
48+
}
49+
50+
try {
51+
var_dump(openssl_csr_sign($wrong, null, $privkey, 365));
52+
} catch (TypeError $exception) {
53+
echo $exception->getMessage() . "\n";
54+
}
4055

4156
try {
4257
openssl_csr_sign(array(), null, $privkey, 365);
@@ -50,33 +65,29 @@ try {
5065
echo $exception->getMessage() . "\n";
5166
}
5267

53-
var_dump(openssl_csr_sign($csr, null, array(), 365));
68+
try {
69+
var_dump(openssl_csr_sign($csr, null, array(), 365));
70+
} catch (ValueError $exception) {
71+
echo $exception->getMessage() . "\n";
72+
}
5473
var_dump(openssl_csr_sign($csr, null, $privkey, 365, $config_arg));
5574
?>
5675
--EXPECTF--
57-
object(OpenSSLCertificate)#%d (0) {
76+
object(OpenSSLCertificate)#3 (0) {
5877
}
59-
object(OpenSSLCertificate)#%d (0) {
78+
object(OpenSSLCertificate)#3 (0) {
6079
}
61-
object(OpenSSLCertificate)#%d (0) {
80+
object(OpenSSLCertificate)#3 (0) {
6281
}
63-
object(OpenSSLCertificate)#%d (0) {
82+
object(OpenSSLCertificate)#4 (0) {
6483
}
65-
66-
Warning: openssl_csr_sign(): X.509 Certificate cannot be retrieved in %s on line %d
67-
bool(false)
84+
openssl_csr_sign(): Argument #2 ($cacert) X.509 Certificate cannot be retrieved
6885

6986
Warning: openssl_csr_sign(): Cannot get private key from parameter 3 in %s on line %d
7087
bool(false)
71-
72-
Warning: openssl_csr_sign(): X.509 Certificate Signing Request cannot be retrieved in %s on line %d
73-
bool(false)
88+
openssl_csr_sign(): Argument #1 ($csr) X.509 Certificate Signing Request cannot be retrieved
7489
openssl_csr_sign(): Argument #1 ($csr) must be of type OpenSSLCertificateSigningRequest|string, array given
7590
openssl_csr_sign(): Argument #2 ($cacert) must be of type OpenSSLCertificate|string|null, array given
76-
77-
Warning: openssl_csr_sign(): Key array must be of the form array(0 => key, 1 => phrase) in %s on line %d
78-
79-
Warning: openssl_csr_sign(): Cannot get private key from parameter 3 in %s on line %d
80-
bool(false)
81-
object(OpenSSLCertificate)#%d (0) {
91+
Key array must be of the form array(0 => key, 1 => phrase)
92+
object(OpenSSLCertificate)#3 (0) {
8293
}

‎ext/openssl/tests/openssl_decrypt_error.phpt

+29-16
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,34 @@ $iv = str_repeat("\0", openssl_cipher_iv_length($method));
1212

1313
$encrypted = openssl_encrypt($data, $method, $password);
1414
var_dump($encrypted); /* Not passing $iv should be the same as all-NULL iv, but with a warning */
15+
1516
var_dump(openssl_encrypt($data, $method, $password, 0, $iv));
17+
1618
var_dump(openssl_decrypt($encrypted, $method, $wrong));
17-
var_dump(openssl_decrypt($encrypted, $wrong, $password));
19+
20+
try {
21+
var_dump(openssl_decrypt($encrypted, $wrong, $password));
22+
} catch (\ValueError $e) {
23+
echo $e->getMessage() . \PHP_EOL;
24+
}
25+
1826
var_dump(openssl_decrypt($wrong, $method, $password));
19-
var_dump(openssl_decrypt($wrong, $wrong, $password));
20-
var_dump(openssl_decrypt($encrypted, $wrong, $wrong));
21-
var_dump(openssl_decrypt($wrong, $wrong, $wrong));
27+
28+
try {
29+
var_dump(openssl_decrypt($wrong, $wrong, $password));
30+
} catch (\ValueError $e) {
31+
echo $e->getMessage() . \PHP_EOL;
32+
}
33+
try {
34+
var_dump(openssl_decrypt($encrypted, $wrong, $wrong));
35+
} catch (\ValueError $e) {
36+
echo $e->getMessage() . \PHP_EOL;
37+
}
38+
try {
39+
var_dump(openssl_decrypt($wrong, $wrong, $wrong));
40+
} catch (\ValueError $e) {
41+
echo $e->getMessage() . \PHP_EOL;
42+
}
2243

2344
// invalid using of an authentication tag
2445
var_dump(openssl_encrypt($data, $method, $password, 0, $iv, $wrong));
@@ -28,19 +49,11 @@ Warning: openssl_encrypt(): Using an empty Initialization Vector (iv) is potenti
2849
string(44) "yof6cPPH4mLee6TOc0YQSrh4dvywMqxGUyjp0lV6+aM="
2950
string(44) "yof6cPPH4mLee6TOc0YQSrh4dvywMqxGUyjp0lV6+aM="
3051
bool(false)
31-
32-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
33-
bool(false)
34-
bool(false)
35-
36-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
37-
bool(false)
38-
39-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
40-
bool(false)
41-
42-
Warning: openssl_decrypt(): Unknown cipher algorithm in %s on line %d
52+
Unknown cipher algorithm
4353
bool(false)
54+
Unknown cipher algorithm
55+
Unknown cipher algorithm
56+
Unknown cipher algorithm
4457

4558
Warning: openssl_encrypt(): The authenticated tag cannot be provided for cipher that doesn not support AEAD in %s on line %d
4659
string(44) "yof6cPPH4mLee6TOc0YQSrh4dvywMqxGUyjp0lV6+aM="

0 commit comments

Comments
 (0)