Skip to content

Commit 2467dfb

Browse files
committed
Fix UB and error propagation when X509_gmtime_adj() fails
This causes UB later on when the certificate is passed to another function: ``` /work/php-src/Zend/zend_string.h:191:2: runtime error: null pointer passed as argument 2, which is declared to never be null #0 0x55cfb9407d94 in zend_string_init /work/php-src/Zend/zend_string.h:191 #1 0x55cfb941ceb6 in add_assoc_stringl_ex /work/php-src/Zend/zend_API.c:1986 #2 0x55cfb7f4c16d in add_assoc_stringl /work/php-src/Zend/zend_API.h:579 #3 0x55cfb7f4cccd in php_openssl_add_assoc_asn1_string /work/php-src/ext/openssl/openssl_backend_common.c:113 #4 0x55cfb7f2eb98 in zif_openssl_x509_parse /work/php-src/ext/openssl/openssl.c:1074 #5 0x55cfb9160993 in zend_test_execute_internal /work/php-src/ext/zend_test/observer.c:306 #6 0x55cfb958ee2d in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER /work/php-src/Zend/zend_vm_execute.h:2154 #7 0x55cfb97854bd in execute_ex /work/php-src/Zend/zend_vm_execute.h:116519 #8 0x55cfb9795c96 in zend_execute /work/php-src/Zend/zend_vm_execute.h:121962 #9 0x55cfb99666c6 in zend_execute_script /work/php-src/Zend/zend.c:1980 #10 0x55cfb919583e in php_execute_script_ex /work/php-src/main/main.c:2645 #11 0x55cfb9195b48 in php_execute_script /work/php-src/main/main.c:2685 #12 0x55cfb996bf48 in do_cli /work/php-src/sapi/cli/php_cli.c:951 #13 0x55cfb996e6a1 in main /work/php-src/sapi/cli/php_cli.c:1362 #14 0x7fb0b68301c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #15 0x7fb0b683028a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e) #16 0x55cfb7e097d4 in _start (/work/php-src/build-dbg-ubsan/sapi/cli/php+0x14097d4) (BuildId: b2b405964cc047ab6da19abaf92a8899a99e4a47) ``` Furthermore, it also simply does not propagate the error to userland. Closes GH-21046.
1 parent 7eb38cd commit 2467dfb

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

ext/openssl/openssl.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3392,8 +3392,11 @@ PHP_FUNCTION(openssl_csr_sign)
33923392
php_openssl_store_errors();
33933393
goto cleanup;
33943394
}
3395-
X509_gmtime_adj(X509_getm_notBefore(new_cert), 0);
3396-
X509_gmtime_adj(X509_getm_notAfter(new_cert), 60*60*24*num_days);
3395+
if (!X509_gmtime_adj(X509_getm_notBefore(new_cert), 0)
3396+
|| !X509_gmtime_adj(X509_getm_notAfter(new_cert), 60*60*24*num_days)) {
3397+
php_openssl_store_errors();
3398+
goto cleanup;
3399+
}
33973400
i = X509_set_pubkey(new_cert, key);
33983401
if (!i) {
33993402
php_openssl_store_errors();

0 commit comments

Comments
 (0)