Skip to content

Commit e8e4ddc

Browse files
kocsismatekocsismate
committed
Improve parameter handling in ext/openssl
Closes GH-6025
1 parent 3053f6f commit e8e4ddc

16 files changed

+301
-308
lines changed

‎ext/openssl/openssl.c

Lines changed: 55 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1182,7 +1182,7 @@ PHP_MINIT_FUNCTION(openssl)
11821182
REGISTER_LONG_CONSTANT("X509_PURPOSE_ANY", X509_PURPOSE_ANY, CONST_CS|CONST_PERSISTENT);
11831183
#endif
11841184

1185-
/* signature algorithm constants */
1185+
/* digest algorithm constants */
11861186
REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA1", OPENSSL_ALGO_SHA1, CONST_CS|CONST_PERSISTENT);
11871187
REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD5", OPENSSL_ALGO_MD5, CONST_CS|CONST_PERSISTENT);
11881188
REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD4", OPENSSL_ALGO_MD4, CONST_CS|CONST_PERSISTENT);
@@ -1563,7 +1563,7 @@ PHP_FUNCTION(openssl_spki_new)
15631563
mdtype = php_openssl_get_evp_md_from_algo(algo);
15641564

15651565
if (!mdtype) {
1566-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
1566+
php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
15671567
goto cleanup;
15681568
}
15691569

@@ -1589,7 +1589,7 @@ PHP_FUNCTION(openssl_spki_new)
15891589

15901590
if (!NETSCAPE_SPKI_sign(spki, pkey, mdtype)) {
15911591
php_openssl_store_errors();
1592-
php_error_docref(NULL, E_WARNING, "Unable to sign with specified algorithm");
1592+
php_error_docref(NULL, E_WARNING, "Unable to sign with specified digest algorithm");
15931593
goto cleanup;
15941594
}
15951595

@@ -1845,7 +1845,7 @@ zend_string* php_openssl_x509_fingerprint(X509 *peer, const char *method, zend_b
18451845
zend_string *ret;
18461846

18471847
if (!(mdtype = EVP_get_digestbyname(method))) {
1848-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
1848+
php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
18491849
return NULL;
18501850
} else if (!X509_digest(peer, mdtype, md, &n)) {
18511851
php_openssl_store_errors();
@@ -2313,7 +2313,7 @@ PHP_FUNCTION(openssl_x509_checkpurpose)
23132313
Z_PARAM_OBJ_OF_CLASS_OR_STR(cert_obj, php_openssl_certificate_ce, cert_str)
23142314
Z_PARAM_LONG(purpose)
23152315
Z_PARAM_OPTIONAL
2316-
Z_PARAM_ARRAY_OR_NULL(zcainfo)
2316+
Z_PARAM_ARRAY(zcainfo)
23172317
Z_PARAM_STRING_OR_NULL(untrusted, untrusted_len)
23182318
ZEND_PARSE_PARAMETERS_END();
23192319

@@ -3753,7 +3753,7 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
37533753
{
37543754
EC_KEY *eckey;
37553755
if (req->curve_name == NID_undef) {
3756-
php_error_docref(NULL, E_WARNING, "Missing configuration value: 'curve_name' not set");
3756+
php_error_docref(NULL, E_WARNING, "Missing configuration value: \"curve_name\" not set");
37573757
return NULL;
37583758
}
37593759
eckey = EC_KEY_new_by_curve_name(req->curve_name);
@@ -4465,11 +4465,13 @@ PHP_FUNCTION(openssl_pkey_get_private)
44654465
size_t passphrase_len = sizeof("")-1;
44664466
php_openssl_pkey_object *key_object;
44674467

4468-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "z|s", &cert, &passphrase, &passphrase_len) == FAILURE) {
4468+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "z|s!", &cert, &passphrase, &passphrase_len) == FAILURE) {
44694469
RETURN_THROWS();
44704470
}
44714471

4472-
PHP_OPENSSL_CHECK_SIZE_T_TO_INT(passphrase_len, passphrase, 2);
4472+
if (passphrase) {
4473+
PHP_OPENSSL_CHECK_SIZE_T_TO_INT(passphrase_len, passphrase, 2);
4474+
}
44734475

44744476
pkey = php_openssl_pkey_from_zval(cert, 0, passphrase, passphrase_len);
44754477
if (pkey == NULL) {
@@ -4805,7 +4807,7 @@ PHP_FUNCTION(openssl_pbkdf2)
48054807
}
48064808

48074809
if (!digest) {
4808-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
4810+
php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
48094811
RETURN_FALSE;
48104812
}
48114813

@@ -4847,7 +4849,7 @@ PHP_FUNCTION(openssl_pkcs7_verify)
48474849

48484850
RETVAL_LONG(-1);
48494851

4850-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "pl|pappp", &filename, &filename_len,
4852+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "pl|p!ap!p!p!", &filename, &filename_len,
48514853
&flags, &signersfilename, &signersfilename_len, &cainfo,
48524854
&extracerts, &extracerts_len, &datafilename, &datafilename_len, &p7bfilename, &p7bfilename_len) == FAILURE) {
48534855
RETURN_THROWS();
@@ -6082,7 +6084,7 @@ PHP_FUNCTION(openssl_cms_decrypt)
60826084
Z_PARAM_PATH(outfilename, outfilename_len)
60836085
Z_PARAM_ZVAL(recipcert)
60846086
Z_PARAM_OPTIONAL
6085-
Z_PARAM_ZVAL(recipkey)
6087+
Z_PARAM_ZVAL_OR_NULL(recipkey)
60866088
Z_PARAM_LONG(encoding)
60876089
ZEND_PARSE_PARAMETERS_END();
60886090

@@ -6128,8 +6130,7 @@ PHP_FUNCTION(openssl_cms_decrypt)
61286130
cms = SMIME_read_CMS(in, &datain);
61296131
break;
61306132
default:
6131-
php_error_docref(NULL, E_WARNING,
6132-
"Unknown OPENSSL encoding");
6133+
zend_argument_value_error(5, "must be an OPENSSL_ENCODING_* constant");
61336134
goto clean_exit;
61346135
}
61356136

@@ -6456,13 +6457,18 @@ PHP_FUNCTION(openssl_sign)
64566457
char * data;
64576458
size_t data_len;
64586459
EVP_MD_CTX *md_ctx;
6459-
zval *method = NULL;
6460-
zend_long signature_algo = OPENSSL_ALGO_SHA1;
6460+
zend_string *method_str = NULL;
6461+
zend_long method_long = OPENSSL_ALGO_SHA1;
64616462
const EVP_MD *mdtype;
64626463

6463-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "szz|z", &data, &data_len, &signature, &key, &method) == FAILURE) {
6464-
RETURN_THROWS();
6465-
}
6464+
ZEND_PARSE_PARAMETERS_START(3, 4)
6465+
Z_PARAM_STRING(data, data_len)
6466+
Z_PARAM_ZVAL(signature)
6467+
Z_PARAM_ZVAL(key)
6468+
Z_PARAM_OPTIONAL
6469+
Z_PARAM_STR_OR_LONG(method_str, method_long)
6470+
ZEND_PARSE_PARAMETERS_END();
6471+
64666472
pkey = php_openssl_pkey_from_zval(key, 0, "", 0);
64676473
if (pkey == NULL) {
64686474
if (!EG(exception)) {
@@ -6471,20 +6477,13 @@ PHP_FUNCTION(openssl_sign)
64716477
RETURN_FALSE;
64726478
}
64736479

6474-
if (method == NULL || Z_TYPE_P(method) == IS_LONG) {
6475-
if (method != NULL) {
6476-
signature_algo = Z_LVAL_P(method);
6477-
}
6478-
mdtype = php_openssl_get_evp_md_from_algo(signature_algo);
6479-
} else if (Z_TYPE_P(method) == IS_STRING) {
6480-
mdtype = EVP_get_digestbyname(Z_STRVAL_P(method));
6480+
if (method_str) {
6481+
mdtype = EVP_get_digestbyname(ZSTR_VAL(method_str));
64816482
} else {
6482-
// TODO Use proper ZPP check.
6483-
zend_argument_type_error(4, "must be of type string|int|null, %s given" , zend_zval_type_name(method));
6484-
RETURN_THROWS();
6483+
mdtype = php_openssl_get_evp_md_from_algo(method_long);
64856484
}
64866485
if (!mdtype) {
6487-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
6486+
php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
64886487
RETURN_FALSE;
64896488
}
64906489

@@ -6522,29 +6521,26 @@ PHP_FUNCTION(openssl_verify)
65226521
size_t data_len;
65236522
char * signature;
65246523
size_t signature_len;
6525-
zval *method = NULL;
6526-
zend_long signature_algo = OPENSSL_ALGO_SHA1;
6524+
zend_string *method_str = NULL;
6525+
zend_long method_long = OPENSSL_ALGO_SHA1;
65276526

6528-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "ssz|z", &data, &data_len, &signature, &signature_len, &key, &method) == FAILURE) {
6529-
RETURN_THROWS();
6530-
}
6527+
ZEND_PARSE_PARAMETERS_START(3, 4)
6528+
Z_PARAM_STRING(data, data_len)
6529+
Z_PARAM_STRING(signature, signature_len)
6530+
Z_PARAM_ZVAL(key)
6531+
Z_PARAM_OPTIONAL
6532+
Z_PARAM_STR_OR_LONG(method_str, method_long)
6533+
ZEND_PARSE_PARAMETERS_END();
65316534

65326535
PHP_OPENSSL_CHECK_SIZE_T_TO_UINT(signature_len, signature, 2);
65336536

6534-
if (method == NULL || Z_TYPE_P(method) == IS_LONG) {
6535-
if (method != NULL) {
6536-
signature_algo = Z_LVAL_P(method);
6537-
}
6538-
mdtype = php_openssl_get_evp_md_from_algo(signature_algo);
6539-
} else if (Z_TYPE_P(method) == IS_STRING) {
6540-
mdtype = EVP_get_digestbyname(Z_STRVAL_P(method));
6537+
if (method_str) {
6538+
mdtype = EVP_get_digestbyname(ZSTR_VAL(method_str));
65416539
} else {
6542-
// TODO Use proper ZPP check.
6543-
zend_argument_type_error(4, "must be of type string|int|null, %s given" , zend_zval_type_name(method));
6544-
RETURN_THROWS();
6540+
mdtype = php_openssl_get_evp_md_from_algo(method_long);
65456541
}
65466542
if (!mdtype) {
6547-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
6543+
php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
65486544
RETURN_FALSE;
65496545
}
65506546

@@ -6579,8 +6575,8 @@ PHP_FUNCTION(openssl_seal)
65796575
unsigned char iv_buf[EVP_MAX_IV_LENGTH + 1], *buf = NULL, **eks;
65806576
char * data;
65816577
size_t data_len;
6582-
char *method =NULL;
6583-
size_t method_len = 0;
6578+
char *method;
6579+
size_t method_len;
65846580
const EVP_CIPHER *cipher;
65856581
EVP_CIPHER_CTX *ctx;
65866582

@@ -6600,13 +6596,13 @@ PHP_FUNCTION(openssl_seal)
66006596

66016597
cipher = EVP_get_cipherbyname(method);
66026598
if (!cipher) {
6603-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
6599+
php_error_docref(NULL, E_WARNING, "Unknown cipher algorithm");
66046600
RETURN_FALSE;
66056601
}
66066602

66076603
iv_len = EVP_CIPHER_iv_length(cipher);
66086604
if (!iv && iv_len > 0) {
6609-
zend_argument_value_error(6, "must provide an IV for chosen cipher algorithm");
6605+
zend_argument_value_error(6, "cannot be null for the chosen cipher algorithm");
66106606
RETURN_THROWS();
66116607
}
66126608

@@ -6707,11 +6703,11 @@ PHP_FUNCTION(openssl_open)
67076703
size_t data_len;
67086704
char * ekey;
67096705
size_t ekey_len;
6710-
char *method = NULL, *iv = NULL;
6711-
size_t method_len = 0, iv_len = 0;
6706+
char *method, *iv = NULL;
6707+
size_t method_len, iv_len = 0;
67126708
const EVP_CIPHER *cipher;
67136709

6714-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "szszs|s", &data, &data_len, &opendata,
6710+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "szszs|s!", &data, &data_len, &opendata,
67156711
&ekey, &ekey_len, &privkey, &method, &method_len, &iv, &iv_len) == FAILURE) {
67166712
RETURN_THROWS();
67176713
}
@@ -6729,14 +6725,14 @@ PHP_FUNCTION(openssl_open)
67296725

67306726
cipher = EVP_get_cipherbyname(method);
67316727
if (!cipher) {
6732-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
6728+
php_error_docref(NULL, E_WARNING, "Unknown cipher algorithm");
67336729
RETURN_FALSE;
67346730
}
67356731

67366732
cipher_iv_len = EVP_CIPHER_iv_length(cipher);
67376733
if (cipher_iv_len > 0) {
67386734
if (!iv) {
6739-
zend_argument_value_error(6, "must provide an IV for chosen cipher algorithm");
6735+
zend_argument_value_error(6, "cannot be null for the chosen cipher algorithm");
67406736
RETURN_THROWS();
67416737
}
67426738
if ((size_t)cipher_iv_len != iv_len) {
@@ -6782,7 +6778,7 @@ static void php_openssl_add_method(const OBJ_NAME *name, void *arg) /* {{{ */
67826778
}
67836779
/* }}} */
67846780

6785-
/* {{{ Return array of available digest methods */
6781+
/* {{{ Return array of available digest algorithms */
67866782
PHP_FUNCTION(openssl_get_md_methods)
67876783
{
67886784
zend_bool aliases = 0;
@@ -6797,7 +6793,7 @@ PHP_FUNCTION(openssl_get_md_methods)
67976793
}
67986794
/* }}} */
67996795

6800-
/* {{{ Return array of available cipher methods */
6796+
/* {{{ Return array of available cipher algorithms */
68016797
PHP_FUNCTION(openssl_get_cipher_methods)
68026798
{
68036799
zend_bool aliases = 0;
@@ -6858,7 +6854,7 @@ PHP_FUNCTION(openssl_digest)
68586854
}
68596855
mdtype = EVP_get_digestbyname(method);
68606856
if (!mdtype) {
6861-
php_error_docref(NULL, E_WARNING, "Unknown signature algorithm");
6857+
php_error_docref(NULL, E_WARNING, "Unknown digest algorithm");
68626858
RETURN_FALSE;
68636859
}
68646860

@@ -7012,7 +7008,7 @@ static int php_openssl_cipher_init(const EVP_CIPHER *cipher_type,
70127008
}
70137009
} else if (!enc && tag && tag_len > 0) {
70147010
if (!mode->is_aead) {
7015-
php_error_docref(NULL, E_WARNING, "The tag cannot be used because the cipher method does not support AEAD");
7011+
php_error_docref(NULL, E_WARNING, "The tag cannot be used because the cipher algorithm does not support AEAD");
70167012
} else if (!EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_set_tag_flag, tag_len, (unsigned char *) tag)) {
70177013
php_error_docref(NULL, E_WARNING, "Setting tag for AEAD cipher decryption failed");
70187014
return FAILURE;
@@ -7024,7 +7020,7 @@ static int php_openssl_cipher_init(const EVP_CIPHER *cipher_type,
70247020
if (key_len > password_len) {
70257021
if ((OPENSSL_DONT_ZERO_PAD_KEY & options) && !EVP_CIPHER_CTX_set_key_length(cipher_ctx, password_len)) {
70267022
php_openssl_store_errors();
7027-
php_error_docref(NULL, E_WARNING, "Key length cannot be set for the cipher method");
7023+
php_error_docref(NULL, E_WARNING, "Key length cannot be set for the cipher algorithm");
70287024
return FAILURE;
70297025
}
70307026
key = emalloc(key_len);

0 commit comments

Comments
 (0)