mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Abort on invalid IV size

Browse Source 
Previously, if the size of the IV did not match the block size
mcrypt would throw a warning and fall back to a NUL IV. This
behavior is both dangerous and makes no practical sense.

mcrypt_encrypt etc. will now return false if the IV has an incorrect
size.
This commit is contained in:
Nikita Popov 2014-03-01 15:29:20 +01:00
parent 1b922895fc
commit c4b7cdb41e
9 changed files with 78 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/mcrypt/mcrypt.c
View File

@ -1223,6 +1223,8 @@ static void php_mcrypt_do_crypt(char* cipher, const char *key, int key_len, cons
if (argc == 5) {
if (iv_size != iv_len) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, MCRYPT_IV_WRONG_SIZE);
efree(key_s);
RETURN_FALSE;
} else {
iv_s = emalloc(iv_size + 1);
memcpy(iv_s, iv, iv_size);

4
ext/mcrypt/tests/mcrypt_cbc_3des_decrypt.phpt
View File

@ -100,7 +100,7 @@ iv length=4
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(32) "736563726574206d6573736167650000"
string(0) ""
iv length=8
@ -112,5 +112,5 @@ iv length=9
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(32) "736563726574206d6573736167650000"
string(0) ""
===DONE===

4
ext/mcrypt/tests/mcrypt_cbc_3des_encrypt.phpt
View File

@ -83,7 +83,7 @@ iv length=4
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(112) "440a6f54601969b127aad3c217ce7583c7f7b29989693130645569301db0020b29a34a3dcd104b2d0e3ba19d6cbd8a33d352b9c27cc34ef1"
string(0) ""
iv length=8
@ -95,5 +95,5 @@ iv length=9
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(112) "440a6f54601969b127aad3c217ce7583c7f7b29989693130645569301db0020b29a34a3dcd104b2d0e3ba19d6cbd8a33d352b9c27cc34ef1"
string(0) ""
===DONE===

40
ext/mcrypt/tests/mcrypt_cbc_variation5.phpt
View File

@ -126,47 +126,47 @@ fclose($fp);
--int 0--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--int 1--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--int 12345--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--int -12345--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float 10.5--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float -10.5--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float 12.3456789000e10--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float -12.3456789000e10--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float .5--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--empty array--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
@ -191,47 +191,47 @@ string(0) ""
--uppercase NULL--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--lowercase null--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--lowercase true--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--lowercase false--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--uppercase TRUE--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--uppercase FALSE--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--empty string DQ--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--empty string SQ--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--instance of classWithToString--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--instance of classWithoutToString--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
@ -241,12 +241,12 @@ string(0) ""
--undefined var--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--unset var--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)
Error: 2 - mcrypt_cbc(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--resource--
Error: 8192 - Function mcrypt_cbc() is deprecated, %s(%d)

4
ext/mcrypt/tests/mcrypt_decrypt_3des_cbc.phpt
View File

@ -89,7 +89,7 @@ string(32) "736563726574206d6573736167650000"
iv length=4
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(32) "736563726574206d6573736167650000"
string(0) ""
iv length=8
string(32) "736563726574206d6573736167650000"
@ -97,5 +97,5 @@ string(32) "736563726574206d6573736167650000"
iv length=9
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(32) "736563726574206d6573736167650000"
string(0) ""
===DONE===

40
ext/mcrypt/tests/mcrypt_decrypt_variation5.phpt
View File

@ -125,39 +125,39 @@ fclose($fp);
--int 0--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--int 1--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--int 12345--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--int -12345--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--float 10.5--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--float -10.5--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--float 12.3456789000e10--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--float -12.3456789000e10--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--float .5--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--empty array--
Error: 2 - mcrypt_decrypt() expects parameter 5 to be string, array given, %s(%d)
@ -177,39 +177,39 @@ string(0) ""
--uppercase NULL--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--lowercase null--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--lowercase true--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--lowercase false--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--uppercase TRUE--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--uppercase FALSE--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--empty string DQ--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--empty string SQ--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--instance of classWithToString--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--instance of classWithoutToString--
Error: 2 - mcrypt_decrypt() expects parameter 5 to be string, object given, %s(%d)
@ -217,11 +217,11 @@ string(0) ""
--undefined var--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--unset var--
Error: 2 - mcrypt_decrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "a80c6cef6b42c875e2372a0339dc22b0"
string(0) ""
--resource--
Error: 2 - mcrypt_decrypt() expects parameter 5 to be string, resource given, %s(%d)

4
ext/mcrypt/tests/mcrypt_encrypt_3des_cbc.phpt
View File

@ -82,7 +82,7 @@ string(112) "b85e21072239d60c63a80e7c9ae493cb741a1cd407e52f451c5f43a0d103f55a7b6
iv length=4
Warning: mcrypt_encrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(112) "440a6f54601969b127aad3c217ce7583c7f7b29989693130645569301db0020b29a34a3dcd104b2d0e3ba19d6cbd8a33d352b9c27cc34ef1"
string(0) ""
iv length=8
string(112) "bac347506bf092c5557c4363c301745d78f047028e2953e84fd66b30aeb6005812dadbe8baa871b83278341599b0c448ddaaa52b5a378ce5"
@ -90,5 +90,5 @@ string(112) "bac347506bf092c5557c4363c301745d78f047028e2953e84fd66b30aeb6005812d
iv length=9
Warning: mcrypt_encrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(112) "440a6f54601969b127aad3c217ce7583c7f7b29989693130645569301db0020b29a34a3dcd104b2d0e3ba19d6cbd8a33d352b9c27cc34ef1"
string(0) ""
===DONE===

40
ext/mcrypt/tests/mcrypt_encrypt_variation5.phpt
View File

@ -126,39 +126,39 @@ fclose($fp);
--int 0--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--int 1--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--int 12345--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--int -12345--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float 10.5--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float -10.5--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float 12.3456789000e10--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float -12.3456789000e10--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--float .5--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--empty array--
Error: 2 - mcrypt_encrypt() expects parameter 5 to be string, array given, %s(%d)
@ -178,39 +178,39 @@ string(0) ""
--uppercase NULL--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--lowercase null--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--lowercase true--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--lowercase false--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--uppercase TRUE--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--uppercase FALSE--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--empty string DQ--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--empty string SQ--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--instance of classWithToString--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--instance of classWithoutToString--
Error: 2 - mcrypt_encrypt() expects parameter 5 to be string, object given, %s(%d)
@ -218,11 +218,11 @@ string(0) ""
--undefined var--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--unset var--
Error: 2 - mcrypt_encrypt(): The IV parameter must be as long as the blocksize, %s(%d)
string(32) "6438db90653c4d3080c3ceab43618c05"
string(0) ""
--resource--
Error: 2 - mcrypt_encrypt() expects parameter 5 to be string, resource given, %s(%d)

16
ext/mcrypt/tests/mcrypt_rijndael128_128BitKey.phpt
View File

@ -105,30 +105,30 @@ iv length=0
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "c082b3fabaae4c8c410eb8dba64bae10e48d79b5241fb8f24462cad43bd0b35ad2746b00817e9dcbc636b44df0ec60b46a57e7a310a308a0947724e3817a13b4"
string(0) ""
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "546869732069732074686520736563726574206d657373616765207768696368206d75737420626520656e637279707465640000000000000000000000000000"
string(0) ""
iv length=0
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "c082b3fabaae4c8c410eb8dba64bae10e48d79b5241fb8f24462cad43bd0b35ad2746b00817e9dcbc636b44df0ec60b46a57e7a310a308a0947724e3817a13b4"
string(0) ""
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "546869732069732074686520736563726574206d657373616765207768696368206d75737420626520656e637279707465640000000000000000000000000000"
string(0) ""
iv length=8
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "c082b3fabaae4c8c410eb8dba64bae10e48d79b5241fb8f24462cad43bd0b35ad2746b00817e9dcbc636b44df0ec60b46a57e7a310a308a0947724e3817a13b4"
string(0) ""
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "546869732069732074686520736563726574206d657373616765207768696368206d75737420626520656e637279707465640000000000000000000000000000"
string(0) ""
iv length=16
@ -141,8 +141,8 @@ iv length=17
Deprecated: Function mcrypt_cbc() is deprecated in %s on line %d
Warning: mcrypt_cbc(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "c082b3fabaae4c8c410eb8dba64bae10e48d79b5241fb8f24462cad43bd0b35ad2746b00817e9dcbc636b44df0ec60b46a57e7a310a308a0947724e3817a13b4"
string(0) ""
Warning: mcrypt_decrypt(): The IV parameter must be as long as the blocksize in %s on line %d
string(128) "546869732069732074686520736563726574206d657373616765207768696368206d75737420626520656e637279707465640000000000000000000000000000"
string(0) ""
===DONE===