archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source
This commit is contained in:
Jakub Zelenka 2025-08-09 18:02:10 +02:00
commit 75931a2ce3
No known key found for this signature in database
GPG key ID: 1C0779DC5C0A9DE4
2 changed files with 62 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

21
ext/openssl/openssl_backend_common.c
View file

@ -1344,13 +1344,20 @@ EVP_PKEY *php_openssl_pkey_from_zval(
return key; return key;
} }
zend_string *php_openssl_pkey_derive(EVP_PKEY *key, EVP_PKEY *peer_key, size_t key_size) static zend_string *php_openssl_pkey_derive(EVP_PKEY *key, EVP_PKEY *peer_key, size_t requested_key_size) {
{ size_t key_size = requested_key_size;
EVP_PKEY_CTX *ctx = php_openssl_pkey_new_from_pkey(key); EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new(key, NULL);
if (!ctx) { if (!ctx) {
return NULL; return NULL;
} }
#if OPENSSL_VERSION_NUMBER < 0x30000000L
/* OpenSSL 1.1 does not respect key_size for DH, so force size discovery so it can be compared later. */
if (EVP_PKEY_base_id(key) == EVP_PKEY_DH && key_size != 0) {
key_size = 0;
}
#endif
if (EVP_PKEY_derive_init(ctx) <= 0 || if (EVP_PKEY_derive_init(ctx) <= 0 ||
EVP_PKEY_derive_set_peer(ctx, peer_key) <= 0 || EVP_PKEY_derive_set_peer(ctx, peer_key) <= 0 ||
(key_size == 0 && EVP_PKEY_derive(ctx, NULL, &key_size) <= 0)) { (key_size == 0 && EVP_PKEY_derive(ctx, NULL, &key_size) <= 0)) {
@ -1359,6 +1366,14 @@ zend_string *php_openssl_pkey_derive(EVP_PKEY *key, EVP_PKEY *peer_key, size_t k
return NULL; return NULL;
} }
#if OPENSSL_VERSION_NUMBER < 0x30000000L
/* Now compare the computed size for DH to mirror OpenSSL 3.0+ behavior. */
if (EVP_PKEY_base_id(key) == EVP_PKEY_DH && requested_key_size > 0 && requested_key_size < key_size) {
EVP_PKEY_CTX_free(ctx);
return NULL;
}
#endif
zend_string *result = zend_string_alloc(key_size, 0); zend_string *result = zend_string_alloc(key_size, 0);
if (EVP_PKEY_derive(ctx, (unsigned char *)ZSTR_VAL(result), &key_size) <= 0) { if (EVP_PKEY_derive(ctx, (unsigned char *)ZSTR_VAL(result), &key_size) <= 0) {
php_openssl_store_errors(); php_openssl_store_errors();

44
ext/openssl/tests/gh19428.phpt Normal file
View file

@ -0,0 +1,44 @@
--TEST--
GH-19428: openssl_pkey_derive() DH with low key_length
--EXTENSIONS--
openssl
--FILE--
<?php
$priv = openssl_pkey_get_private("-----BEGIN PRIVATE KEY-----
MIICJgIBADCCARcGCSqGSIb3DQEDATCCAQgCggEBAJLxRCaZ933uW+AXmabHFDDy
upojBIRlbmQLJZfigDaSA1f9YOTsIv+WwVFTX/J1mtCyx9uBcz0Nt2kmVwxWuc2f
VtCEMPsmLsVXX7xRUFLpyX1Y1IYGBVXQOoOvLWYQjpZgnx47Pkh1Ok1+smffztfC
0DCNt4KorWrbsPcmqBejXHN79KvWFjZmXOksRiNu/Bn76RiqvofC4z8Ri3kHXQG2
197JGZzzFXHadGC3xbkg8UxsNbYhVMKbm0iANfafUH7/hoS9UjAVQYtvwe7YNiW/
HnyfVCrKwcc7sadd8Iphh+3lf5P1AhaQEAMytanrzq9RDXKBxuvpSJifRYasZYsC
AQIEggEEAoIBAGwAYC2E81Y1U2Aox0U7u1+vBcbht/OO87tutMvc4NTLf6NLPHsW
cPqBixs+3rSn4fADzAIvdLBmogjtiIZoB6qyHrllF/2xwTVGEeYaZIupQH3bMK2b
6eUvnpuu4Ytksiz6VpXBBRMrIsj3frM+zUtnq8vKUr+TbjV2qyKR8l3eNDwzqz30
dlbKh9kIhZafclHfRVfyp+fVSKPfgrRAcLUgAbsVjOjPeJ90xQ4DTMZ6vjiv6tHM
hkSjJIcGhRtSBzVF/cT38GyCeTmiIA/dRz2d70lWrqDQCdp9ArijgnpjNKAAulSY
CirnMsGZTDGmLOHg4xOZ5FEAzZI2sFNLlcw=
-----END PRIVATE KEY-----
");
$pub = openssl_pkey_get_public("-----BEGIN PUBLIC KEY-----
MIICJDCCARcGCSqGSIb3DQEDATCCAQgCggEBAJLxRCaZ933uW+AXmabHFDDyupoj
BIRlbmQLJZfigDaSA1f9YOTsIv+WwVFTX/J1mtCyx9uBcz0Nt2kmVwxWuc2fVtCE
MPsmLsVXX7xRUFLpyX1Y1IYGBVXQOoOvLWYQjpZgnx47Pkh1Ok1+smffztfC0DCN
t4KorWrbsPcmqBejXHN79KvWFjZmXOksRiNu/Bn76RiqvofC4z8Ri3kHXQG2197J
GZzzFXHadGC3xbkg8UxsNbYhVMKbm0iANfafUH7/hoS9UjAVQYtvwe7YNiW/Hnyf
VCrKwcc7sadd8Iphh+3lf5P1AhaQEAMytanrzq9RDXKBxuvpSJifRYasZYsCAQID
ggEFAAKCAQAiCSBpxvGgsTorxAWtcAlSmzAJnJxFgSPef0g7OjhESytnc8G2QYmx
ovMt5KVergcitztWh08hZQUdAYm4rI+zMlAFDdN8LWwBT/mGKSzRkWeprd8E7mvy
ucqC1YXCMqmIwPySvLQUB/Dl8kgau7BLAnIJm8VP+MVrn8g9gghD0qRCgPgtEaDV
vocfgnOU43rhKnIgO0cHOKtw2qybSFB8QuZrYugq4j8Bwkrzh6rdMMeyMl/ej5Aj
c0wamOzuBDtXt0T9+Fx3khHaowjCc7xJZRgZCxg43SbqMWJ9lUg94I7+LTX61Gyv
dtlkbGbtoDOnxeNnN93gwQZngGYZYciu
-----END PUBLIC KEY-----
");
var_dump(openssl_pkey_derive($pub, $priv, 10));
?>
--EXPECT--
bool(false)