Skip to content

Commit c2eadb4

Browse files
committed
Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails
The X509_NAME_oneline() function can return NULL, which will cause a crash when the string length is computed via add_assoc_string(). Closes GH-21011.
1 parent 7754eaf commit c2eadb4

File tree

2 files changed

+8
-0
lines changed

2 files changed

+8
-0
lines changed

NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ PHP NEWS
3232

3333
- OpenSSL:
3434
. Fix memory leaks when sk_X509_new_null() fails. (ndossche)
35+
. Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
36+
(ndossche)
3537

3638
- Phar:
3739
. Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).

ext/openssl/openssl.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2166,6 +2166,12 @@ PHP_FUNCTION(openssl_x509_parse)
21662166
}
21672167

21682168
str_serial = i2s_ASN1_INTEGER(NULL, asn1_serial);
2169+
/* Can return NULL on error or memory allocation failure */
2170+
if (!str_serial) {
2171+
php_openssl_store_errors();
2172+
goto err;
2173+
}
2174+
21692175
add_assoc_string(return_value, "serialNumber", str_serial);
21702176
OPENSSL_free(str_serial);
21712177

0 commit comments

Comments
 (0)