mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-27 11:53:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #73072 (Invalid path SNI_server_certs causes segfault)

Browse Source
This commit is contained in:
Jakub Zelenka 2016-09-13 18:15:34 +01:00
parent c43ecfd798
commit 05baa92727
3 changed files with 55 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@ -29,6 +29,10 @@ PHP NEWS
. Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
(Keyur) (julien backport)
- OpenSSL:
. Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
(Jakub Zelenka)
- Session:
. Fixed bug #68015 (Session does not report invalid uid for files save handler).
(Yasuo)

45
ext/openssl/tests/bug73072.phpt Normal file
View File

@ -0,0 +1,45 @@
--TEST--
Bug #73072: Invalid path SNI_server_certs causes segfault
--SKIPIF--
<?php
if (!extension_loaded("openssl")) die("skip openssl not loaded");
?>
--FILE--
<?php
$serverCode = <<<'CODE'
$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
$ctx = stream_context_create(['ssl' => [
'local_cert' => __DIR__ . '/domain1.pem',
'SNI_server_certs' => [
"domain1.com" => __DIR__ . "/sni_server_domain1.pem",
"domain2.com" => __DIR__ . "/not_existing.pem",
]
]]);
$server = stream_socket_server('tls://127.0.0.1:64322', $errno, $errstr, $flags, $ctx);
phpt_notify();
@stream_socket_accept($server, 3);
// if there is a segfault, this won't be called
fwrite(STDERR, "done\n");
CODE;
$clientCode = <<<'CODE'
$flags = STREAM_CLIENT_CONNECT;
$ctxArr = [
'cafile' => __DIR__ . '/sni_server_ca.pem',
'capture_peer_cert' => true
];
phpt_wait();
$ctxArr['peer_name'] = 'domain1.com';
$ctx = stream_context_create(['ssl' => $ctxArr]);
@stream_socket_client("tls://127.0.0.1:64322", $errno, $errstr, 1, $flags, $ctx);
CODE;
include 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
?>
--EXPECT--
done

9
ext/openssl/xp_ssl.c
View File

@ -1355,6 +1355,7 @@ static int enable_server_sni(php_stream *stream, php_openssl_netstream_data_t *s
sslsock->sni_certs = (php_openssl_sni_cert_t*)safe_pemalloc(sslsock->sni_cert_count,
sizeof(php_openssl_sni_cert_t), 0, php_stream_is_persistent(stream)
);
memset(sslsock->sni_certs, 0, sslsock->sni_cert_count * sizeof(php_openssl_sni_cert_t));
for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(val), &pos);
zend_hash_get_current_data_ex(Z_ARRVAL_PP(val), (void **)&current, &pos) == SUCCESS;
@ -2053,9 +2054,11 @@ static int php_openssl_sockop_close(php_stream *stream, int close_handle TSRMLS_
}
if (sslsock->sni_certs) {
for (i=0; i<sslsock->sni_cert_count; i++) {
SSL_CTX_free(sslsock->sni_certs[i].ctx);
pefree(sslsock->sni_certs[i].name, php_stream_is_persistent(stream));
for (i = 0; i < sslsock->sni_cert_count; i++) {
if (sslsock->sni_certs[i].ctx) {
SSL_CTX_free(sslsock->sni_certs[i].ctx);
pefree(sslsock->sni_certs[i].name, php_stream_is_persistent(stream));
}
}
pefree(sslsock->sni_certs, php_stream_is_persistent(stream));
sslsock->sni_certs = NULL;