Skip to content

Simplify php_openssl_load_all_certs_from_file() #21430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
botovq wants to merge 1 commit into
base: master
Choose a base branch
from
+11 −7
Open

Simplify php_openssl_load_all_certs_from_file() #21430

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions ext/openssl/openssl_backend_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -691,6 +691,7 @@ STACK_OF(X509) *php_openssl_load_all_certs_from_file(
BIO *in=NULL;
X509_INFO *xi;
char cert_path[MAXPATHLEN];
int i;

if (!php_openssl_check_path(cert_file, cert_file_len, cert_path, arg_num)) {
goto end;
Expand All @@ -709,29 +710,32 @@ STACK_OF(X509) *php_openssl_load_all_certs_from_file(
goto end;
}

if(!(stack = sk_X509_new_reserve(NULL, sk_X509_INFO_num(sk)))) {
if(!(stack = sk_X509_new_null())) {
Copy link
Copy Markdown
Member

@bukka bukka Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this changed? sk_X509_new_reserve pre-allocates space for the certs which should be better so don't exactly get why it was replaced...

Copy link
Copy Markdown
Author

@botovq botovq Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be honest, I took a look at this because LibreSSL doesn't have sk_reserve and really doesn't want to add it if at all possible. There are currently no unconditional uses of this API and it would be nice if it stayed this way. It is a pretty bad interface that tends to attracts bugs (like in the case at hand) because whenever you think you need it, you almost certainly have ownership handling that could be improved instead.

So I thought I'd simply switch it back to what it was before 4b9e80e because I assumed the use of sk_reserve() was precisely to avoid having to error check sk_push().

php_openssl_store_errors();
goto end;
}

/* scan over it and pull out the certs */
while (sk_X509_INFO_num(sk)) {
xi=sk_X509_INFO_shift(sk);
for (i = 0; i < sk_X509_INFO_num(sk); i++) {
xi=sk_X509_INFO_value(sk,i);
Copy link
Copy Markdown
Member

@bukka bukka Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
xi=sk_X509_INFO_value(sk,i);
xi = sk_X509_INFO_value(sk,i);

when you are in it...

if (xi->x509 != NULL) {
sk_X509_push(stack,xi->x509);
if (!sk_X509_push(stack,xi->x509)) {
php_error_docref(NULL, E_ERROR, "Memory allocation failure");
goto end;
}
xi->x509=NULL;
}
X509_INFO_free(xi);
}
if (!sk_X509_num(stack)) {
php_error_docref(NULL, E_WARNING, "No certificates in file, %s", cert_path);
sk_X509_free(stack);
goto end;
}
ret = stack;
stack = NULL;
end:
BIO_free(in);
sk_X509_INFO_free(sk);
sk_X509_INFO_pop_free(sk,X509_INFO_free);
sk_X509_pop_free(stack,X509_free);

return ret;
}
Expand Down
Loading