Skip to content

Commit 500b0fe

Browse files
bukkabukka
committed
Merge branch 'PHP-8.3'
2 parents 6f215e0 + b394774 commit 500b0fe

File tree

3 files changed

+83
-41
lines changed

3 files changed

+83
-41
lines changed

‎ext/openssl/openssl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5468,7 +5468,7 @@ PHP_FUNCTION(openssl_pkcs7_verify)
54685468
signersfilename, signersfilename_len, 3, PHP_OPENSSL_BIO_MODE_W(PKCS7_BINARY));
54695469
if (certout) {
54705470
int i;
5471-
signers = PKCS7_get0_signers(p7, NULL, (int)flags);
5471+
signers = PKCS7_get0_signers(p7, others, (int)flags);
54725472
if (signers != NULL) {
54735473

54745474
for (i = 0; i < sk_X509_num(signers); i++) {

‎ext/openssl/tests/CertificateGenerator.inc

Lines changed: 42 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,8 @@ class CertificateGenerator
8585
openssl_x509_export_to_file($this->ca, $file);
8686
}
8787

88-
public function saveNewCertAndKey(
89-
$commonNameForCert, $certFile, $keyFile, $keyLength = null, $subjectAltName = null
88+
private function generateCertAndKey(
89+
$commonNameForCert, $file, $keyLength = null, $subjectAltName = null
9090
) {
9191
$dn = [
9292
'countryName' => 'BY',
@@ -117,51 +117,53 @@ $subjectAltNameConfig
117117
basicConstraints = CA:FALSE
118118
$subjectAltNameConfig
119119
CONFIG;
120-
$configFile = $certFile . '.cnf';
120+
$configFile = $file . '.cnf';
121121
file_put_contents($configFile, $configCode);
122122

123-
try {
124-
$config = [
125-
'config' => $configFile,
126-
'req_extensions' => 'v3_req',
127-
'x509_extensions' => 'usr_cert',
128-
];
129-
130-
$this->lastKey = self::generateKey($keyLength);
131-
$csr = openssl_csr_new($dn, $this->lastKey, $config);
132-
$this->lastCert = openssl_csr_sign(
133-
$csr,
134-
$this->ca,
135-
$this->caKey,
136-
/* days */ 2,
137-
$config,
138-
);
139-
if (!$this->lastCert) {
140-
throw new Exception('Failed to create certificate');
141-
}
142-
143-
$certText = '';
144-
openssl_x509_export($this->lastCert, $certText);
145-
146-
$keyText = '';
147-
openssl_pkey_export($this->lastKey, $keyText, null, $config);
148-
149-
if ($certFile === $keyFile) {
150-
file_put_contents($certFile, $certText . PHP_EOL . $keyText);
151-
} else {
152-
file_put_contents($certFile, $certText);
153-
file_put_contents($keyFile, $keyText);
154-
}
155-
} finally {
156-
unlink($configFile);
157-
}
158-
}
123+
$config = [
124+
'config' => $configFile,
125+
'req_extensions' => 'v3_req',
126+
'x509_extensions' => 'usr_cert',
127+
];
128+
129+
$this->lastKey = self::generateKey($keyLength);
130+
$csr = openssl_csr_new($dn, $this->lastKey, $config);
131+
$this->lastCert = openssl_csr_sign(
132+
$csr,
133+
$this->ca,
134+
$this->caKey,
135+
/* days */ 2,
136+
$config,
137+
);
159138

139+
return $config;
140+
}
160141

161142
public function saveNewCertAsFileWithKey(
162143
$commonNameForCert, $file, $keyLength = null, $subjectAltName = null
163144
) {
164-
$this->saveNewCertAndKey($commonNameForCert, $file, $file, $keyLength, $subjectAltName);
145+
$config = $this->generateCertAndKey($commonNameForCert, $file, $keyLength, $subjectAltName);
146+
147+
$certText = '';
148+
openssl_x509_export($this->lastCert, $certText);
149+
150+
$keyText = '';
151+
openssl_pkey_export($this->lastKey, $keyText, null, $config);
152+
153+
file_put_contents($file, $certText . PHP_EOL . $keyText);
154+
155+
unlink($config['config']);
156+
}
157+
158+
public function saveNewCertAndKey(
159+
$commonNameForCert, $certFile, $keyFile, $keyLength = null, $subjectAltName = null
160+
) {
161+
$config = $this->generateCertAndKey($commonNameForCert, $certFile, $keyLength, $subjectAltName);
162+
163+
openssl_x509_export_to_file($this->lastCert, $certFile);
164+
openssl_pkey_export_to_file($this->lastKey, $keyFile, null, $config);
165+
166+
unlink($config['config']);
165167
}
166168

167169
public function getCertDigest($algo)

‎ext/openssl/tests/bug50713.phpt

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
--TEST--
2+
Bug #50713 (openssl_pkcs7_verify() may ignore untrusted CAs)
3+
--EXTENSIONS--
4+
openssl
5+
--FILE--
6+
<?php
7+
$inFile = __DIR__ . "/plain.txt";
8+
$outFile = __DIR__ . '/bug50713-out.pem';
9+
$signersFile = __DIR__ . '/bug50713-signers.pem';
10+
$keyFile = __DIR__ . '/bug50713-key.pem';
11+
$certFile = __DIR__ . '/bug50713-crt.pem';
12+
$cacertFile = __DIR__ . '/bug50713-ca.pem';
13+
14+
include 'CertificateGenerator.inc';
15+
$certificateGenerator = new CertificateGenerator();
16+
$certificateGenerator->saveCaCert($cacertFile);
17+
$certificateGenerator->saveNewCertAndKey('bug50713', $certFile, $keyFile, 1024);
18+
19+
var_dump(openssl_pkcs7_sign($inFile, $outFile, 'file://' . $certFile, 'file://' . $keyFile, [], PKCS7_NOCERTS));
20+
var_dump(openssl_pkcs7_verify($outFile, 0, $signersFile, [$cacertFile], $certFile));
21+
var_dump(strlen(file_get_contents($signersFile)) > 0);
22+
?>
23+
--CLEAN--
24+
<?php
25+
$outFile = __DIR__ . '/bug50713-out.pem';
26+
$signersFile = __DIR__ . '/bug50713-signers.pem';
27+
$keyFile = __DIR__ . '/bug50713-key.pem';
28+
$certFile = __DIR__ . '/bug50713-crt.pem';
29+
$cacertFile = __DIR__ . '/bug50713-ca.pem';
30+
31+
@unlink($signersFile);
32+
@unlink($outFile);
33+
@unlink($keyFile);
34+
@unlink($certFile);
35+
@unlink($cacertFile);
36+
?>
37+
--EXPECT--
38+
bool(true)
39+
bool(true)
40+
bool(true)

0 commit comments

Comments
 (0)