My Alpine packages repository.
https://dryabzhinsky.noip.me/packages/en/alpinelinux-support/
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
94 lines
3.9 KiB
94 lines
3.9 KiB
From: Markus Koschany <apo@debian.org> |
|
Date: Sun, 16 Jul 2017 18:42:56 +0200 |
|
Subject: CVE-2017-11144 |
|
|
|
Bug-Upstream: https://bugs.php.net/bug.php?id=74651 |
|
Origin: https://git.php.net/?p=php-src.git;a=commitdiff;h=89637c6b41b510c20d262c17483f582f115c66d6 |
|
--- |
|
ext/openssl/openssl.c | 6 +++--- |
|
ext/openssl/tests/74651.pem | 27 +++++++++++++++++++++++++++ |
|
ext/openssl/tests/bug74651.phpt | 17 +++++++++++++++++ |
|
3 files changed, 47 insertions(+), 3 deletions(-) |
|
create mode 100644 ext/openssl/tests/74651.pem |
|
create mode 100644 ext/openssl/tests/bug74651.phpt |
|
|
|
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c |
|
index c0e3d8a..6cd4754 100755 |
|
--- a/ext/openssl/openssl.c |
|
+++ b/ext/openssl/openssl.c |
|
@@ -4347,15 +4347,15 @@ PHP_FUNCTION(openssl_seal) |
|
buf = emalloc(data_len + EVP_CIPHER_CTX_block_size(&ctx)); |
|
EVP_CIPHER_CTX_cleanup(&ctx); |
|
|
|
- if (!EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) || !EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len)) { |
|
+ if (EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) <= 0 || |
|
+ !EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len) || |
|
+ !EVP_SealFinal(&ctx, buf + len1, &len2)) { |
|
RETVAL_FALSE; |
|
efree(buf); |
|
EVP_CIPHER_CTX_cleanup(&ctx); |
|
goto clean_exit; |
|
} |
|
|
|
- EVP_SealFinal(&ctx, buf + len1, &len2); |
|
- |
|
if (len1 + len2 > 0) { |
|
zval_dtor(sealdata); |
|
buf[len1 + len2] = '\0'; |
|
diff --git a/ext/openssl/tests/74651.pem b/ext/openssl/tests/74651.pem |
|
new file mode 100644 |
|
index 0000000..4ed5905 |
|
--- /dev/null |
|
+++ b/ext/openssl/tests/74651.pem |
|
@@ -0,0 +1,27 @@ |
|
+-----BEGIN CERTIFICATE----- |
|
+MIIEoDCCBAmgAwIBAgIBJzANBgkqhkiG9w0BAQQFADCBkDELMAkGA1UEFhMCUk8x |
|
+EDAOBgNVBAgTB1JvbWFuaWExEDAOBgNVBAcTB0NyYWlvdmExDzANBgNVBAoTBlNl |
|
+cmdpdTETMBEGA1UECxMKU2VyZ2l1IFNSTDESMBAGA1UEAxMJU2VyZ2l1IENBMSMw |
|
+IQYJKoZIhvcNAQkBFhRuX3NlcmdpdUBob3RtYWlsLmNvbTAeFw0wNDA1MTQxMzM0 |
|
+NTZaFw0wNTA1MTQxMzM0NTZaMIGaMQswCQYDVQQGEwJSTzEQMA4GA1UECBMHUm9t |
|
+YW5pYTEQMA4GA1UEBxMHQ3JhaW92YTETMBEGA1UEChMKU2VyZ2l1IFNSTDETMBEG |
|
+A1UECxMKU2VyZ2l1IFNSTDEYMBYGA1UEAxMPU2VyZ2l1IHBlcnNvbmFsMSMwIQYJ |
|
+KoZIhvcNAQkBFhRuX3NlcmdpdUBob3RtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEF |
|
+AAOBjQAwgYkCgYEApNj7XXz8T8FcLIWpBniPYom3QcT6T7u0xRPHqtqzj5oboBYp |
|
+DJe5d354/y0gJTpiLt8+fTrPgWXnbHm3pOHgXzTcX6Arani0GDU0/xDi4VkCRGcS |
|
+YqX2sJpcDzAbmK9UDMt3xf/O1B8AJan3RfO0Bm3ozTEPziLMkmsiYr5b/L4CAwEA |
|
+AaOCAfwwggH4MAkGA1UdEwQCMAAwNQYJYIZIAYb4QgENBCgWJkZvciBHcmlkIHVz |
|
+ZSBvbmx5OyByZXF1ZXN0IHRhZyB1c2VyVGFnMBEGCWCGSAGG+EIBAQQEAwIF4DA/ |
|
+BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vbW9iaWxlLmJsdWUtc29mdHdhcmUucm86 |
|
+OTAvY2EvY3JsLnNodG1sMDUGCWCGSAGG+EIBCAQoFiZodHRwOi8vbW9iaWxlLmJs |
|
+dWUtc29mdHdhcmUucm86OTAvcHViLzAhBgNVHREEGjAYgRZzZXJnaXVAYmx1ZXNv |
|
+ZnR3YXJlLnJvMB0GA1UdDgQWBBSwp//5QRXeIzm93TEPl6CyonTg/DCBpwYDVR0j |
|
+BIGfMIGcoYGWpIGTMIGQMQswCQYDVQQGEwJSTzEQMA4GA1UECBMHUm9tYW5pYTEQ |
|
+MA4GA1UEBxMHQ3JhaW92YTEPMA0GA1UEChMGU2VyZ2l1MRMwEQYDVQQLEwpTZXJn |
|
+aXUgU1JMMRIwEAYDVQQDEwlTZXJnaXUgQ0ExIzAhBgkqhkiG9w0BCQEWFG5fc2Vy |
|
+Z2l1QGhvdG1haWwuY29tggEAMAsGA1UdDwQEAwIE8DAjBglghkgBhvhCAQIEFhYU |
|
+aHR0cDovLzYyLjIzMS45OC41Mi8wCwYDKgMEBAQ+52I0MA0GCSqGSIb3DQEBBAUA |
|
+A4GBAIBIOJ+iiLyQfNJEY+IMefayQea0nmuXYY+F+L1DFjSC7xChytgYoPNnKkhh |
|
+3dWPtxbswiqKYUnGi6y3Hi4UhDsOaDW29t2S305hSc2qgjOiNtRYQIVYQ8EHG1k7 |
|
+Fl63S7uCOhnVJt+4MnUK1N6/pwgsp+Z2GvEsDG1qCKnvNpf6 |
|
+-----END CERTIFICATE----- |
|
diff --git a/ext/openssl/tests/bug74651.phpt b/ext/openssl/tests/bug74651.phpt |
|
new file mode 100644 |
|
index 0000000..f86394b |
|
--- /dev/null |
|
+++ b/ext/openssl/tests/bug74651.phpt |
|
@@ -0,0 +1,17 @@ |
|
+--TEST-- |
|
+Bug #74651: negative-size-param (-1) in memcpy in zif_openssl_seal() |
|
+--SKIPIF-- |
|
+<?php |
|
+if (!extension_loaded("openssl")) die("skip openssl not loaded"); |
|
+?> |
|
+--FILE-- |
|
+<?php |
|
+ |
|
+$inputstr = file_get_contents(__DIR__ . "/74651.pem"); |
|
+$pub_key_id = openssl_get_publickey($inputstr); |
|
+var_dump($pub_key_id); |
|
+var_dump(openssl_seal($inputstr, $sealed, $ekeys, array($pub_key_id, $pub_key_id), 'AES-128-ECB')); |
|
+?> |
|
+--EXPECTF-- |
|
+resource(%d) of type (OpenSSL key) |
|
+bool(false) |
|
\ No newline at end of file
|
|
|