mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-30 21:35:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #81502

Browse Source 
Allow $tag to be null. This is the value that openssl_encrypt()
sets it to for non-AEAD ciphers, so we should also accept this
as an input to openssl_decrypt().

Prior to PHP 8.1, null was accepted in weak mode due to the special
treatment of null arguments to internal functions.
This commit is contained in:
Nikita Popov 2021-10-08 14:07:05 +02:00
parent 7ad877ced1
commit 7f0d3f5413
5 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@ -22,6 +22,10 @@ PHP NEWS
- PgSQL:
. Fixed bug #81509 (pg_end_copy still expects a resource). (Matteo)
- OpenSSL:
. Fixed bug #81502 ($tag argument of openssl_decrypt() should accept
null/empty string). (Nikita)
- Standard:
. Fixed bug #81491 (Incorrectly using libsodium for argon2 hashing).
(Dan Pock)

2
ext/openssl/openssl.c
View File

@ -7614,7 +7614,7 @@ PHP_FUNCTION(openssl_decrypt)
size_t data_len, method_len, password_len, iv_len = 0, tag_len = 0, aad_len = 0;
zend_string *ret;
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|lsss", &data, &data_len, &method, &method_len,
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|lss!s", &data, &data_len, &method, &method_len,
&password, &password_len, &options, &iv, &iv_len, &tag, &tag_len, &aad, &aad_len) == FAILURE) {
RETURN_THROWS();
}

2
ext/openssl/openssl.stub.php
View File

@ -236,7 +236,7 @@ function openssl_digest(string $data, string $digest_algo, bool $binary = false)
/** @param string $tag */
function openssl_encrypt(string $data, string $cipher_algo, string $passphrase, int $options = 0, string $iv = "", &$tag = null, string $aad = "", int $tag_length = 16): string|false {}
function openssl_decrypt(string $data, string $cipher_algo, string $passphrase, int $options = 0, string $iv = "", string $tag = "", string $aad = ""): string|false {}
function openssl_decrypt(string $data, string $cipher_algo, string $passphrase, int $options = 0, string $iv = "", ?string $tag = null, string $aad = ""): string|false {}
function openssl_cipher_iv_length(string $cipher_algo): int|false {}

4
ext/openssl/openssl_arginfo.h
View File

@ -1,5 +1,5 @@
/* This is a generated file, edit the .stub.php file instead.
* Stub hash: 3ad007a0b29648c29051f9ee00fe43dd6f2a766d */
* Stub hash: 320aca9647019329a42dc3e7937420610a8a4419 */
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_openssl_x509_export_to_file, 0, 2, _IS_BOOL, 0)
ZEND_ARG_OBJ_TYPE_MASK(0, certificate, OpenSSLCertificate, MAY_BE_STRING, NULL)
@ -342,7 +342,7 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_openssl_decrypt, 0, 3, MAY_BE_ST
ZEND_ARG_TYPE_INFO(0, passphrase, IS_STRING, 0)
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, options, IS_LONG, 0, "0")
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, iv, IS_STRING, 0, "\"\"")
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, tag, IS_STRING, 0, "\"\"")
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, tag, IS_STRING, 1, "null")
ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, aad, IS_STRING, 0, "\"\"")
ZEND_END_ARG_INFO()

7
ext/openssl/tests/openssl_decrypt_basic.phpt
View File

@ -25,6 +25,11 @@ $encrypted = openssl_encrypt($padded_data, $method, $password, OPENSSL_RAW_DATA|
$output = openssl_decrypt($encrypted, $method, $password, OPENSSL_RAW_DATA|OPENSSL_ZERO_PADDING, $iv);
var_dump(rtrim($output));
$output2 = openssl_decrypt($encrypted, $method, $password, OPENSSL_RAW_DATA|OPENSSL_ZERO_PADDING, $iv, tag: '');
var_dump($output2 === $output);
$output3 = openssl_decrypt($encrypted, $method, $password, OPENSSL_RAW_DATA|OPENSSL_ZERO_PADDING, $iv, tag: null);
var_dump($output3 === $output);
if (in_array("bf-ecb", openssl_get_cipher_methods())) {
// if we want to prefer variable length cipher setting
$encrypted = openssl_encrypt($data, "bf-ecb", $password, OPENSSL_DONT_ZERO_PAD_KEY);
@ -45,4 +50,6 @@ string(45) "openssl_encrypt() and openssl_decrypt() tests"
string(45) "openssl_encrypt() and openssl_decrypt() tests"
string(45) "openssl_encrypt() and openssl_decrypt() tests"
bool(true)
bool(true)
bool(true)
NULL