Skip to content

Fix leaks / error propagation in OpenSSL extension on push failure #20986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ndossche wants to merge 5 commits into
base: PHP-8.4
Choose a base branch
from
Open

Fix leaks / error propagation in OpenSSL extension on push failure #20986

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e5de41c
Fix memory leak in php_openssl_load_all_certs_from_file() when push f…
ndossche Jan 20, 2026
994078f
Fix memory leaks in php_array_to_X509_sk() when push fails
ndossche Jan 20, 2026
94bd7cf
Fix missing error propagation when php_array_to_X509_sk() fails
ndossche Jan 20, 2026
2ea9de7
Fix memory leaks in openssl_pkcs7_encrypt() when push fails
ndossche Jan 20, 2026
e75669e
Fix memory leaks in openssl_cms_encrypt() when push fails
ndossche Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 41 additions & 15 deletions ext/openssl/openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2280,29 +2280,25 @@ static STACK_OF(X509) *php_openssl_load_all_certs_from_file(
X509_INFO *xi;
char cert_path[MAXPATHLEN];

if(!(stack = sk_X509_new_null())) {
php_openssl_store_errors();
php_error_docref(NULL, E_ERROR, "Memory allocation failure");
goto end;
}

if (!php_openssl_check_path(cert_file, cert_file_len, cert_path, arg_num)) {
sk_X509_free(stack);
goto end;
}

if (!(in = BIO_new_file(cert_path, PHP_OPENSSL_BIO_MODE_R(PKCS7_BINARY)))) {
php_openssl_store_errors();
php_error_docref(NULL, E_WARNING, "Error opening the file, %s", cert_path);
sk_X509_free(stack);
goto end;
}

/* This loads from a file, a stack of x509/crl/pkey sets */
if (!(sk = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL))) {
php_openssl_store_errors();
php_error_docref(NULL, E_WARNING, "Error reading the file, %s", cert_path);
sk_X509_free(stack);
goto end;
}

if(!(stack = sk_X509_new_reserve(NULL, sk_X509_INFO_num(sk)))) {
php_openssl_store_errors();
goto end;
}

Expand Down Expand Up @@ -2571,7 +2567,10 @@ static STACK_OF(X509) *php_array_to_X509_sk(zval * zcerts, uint32_t arg_num, con
}

}
sk_X509_push(sk, cert);
if (sk_X509_push(sk, cert) <= 0) {
X509_free(cert);
goto push_fail_exit;
}
} ZEND_HASH_FOREACH_END();
} else {
/* a single certificate */
Expand All @@ -2589,11 +2588,20 @@ static STACK_OF(X509) *php_array_to_X509_sk(zval * zcerts, uint32_t arg_num, con
goto clean_exit;
}
}
sk_X509_push(sk, cert);
if (sk_X509_push(sk, cert) <= 0) {
X509_free(cert);
goto push_fail_exit;
}
}

clean_exit:
return sk;

push_fail_exit:
php_openssl_store_errors();
php_sk_X509_free(sk);
sk = NULL;
goto clean_exit;
}
/* }}} */

Expand Down Expand Up @@ -2662,6 +2670,9 @@ PHP_FUNCTION(openssl_pkcs12_export_to_file)

if (args && (item = zend_hash_str_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts")-1)) != NULL) {
ca = php_array_to_X509_sk(item, 5, "extracerts");
if (!ca) {
goto cleanup;
}
}
/* end parse extra config */

Expand Down Expand Up @@ -2755,6 +2766,9 @@ PHP_FUNCTION(openssl_pkcs12_export)

if (args && (item = zend_hash_str_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts")-1)) != NULL) {
ca = php_array_to_X509_sk(item, 5, "extracerts");
if (!ca) {
goto cleanup;
}
}
/* end parse extra config */

Expand Down Expand Up @@ -5818,7 +5832,10 @@ PHP_FUNCTION(openssl_pkcs7_encrypt)
goto clean_exit;
}
}
sk_X509_push(recipcerts, cert);
if (sk_X509_push(recipcerts, cert) <= 0) {
X509_free(cert);
goto clean_exit;
}
} ZEND_HASH_FOREACH_END();
} else {
/* a single certificate */
Expand All @@ -5839,7 +5856,10 @@ PHP_FUNCTION(openssl_pkcs7_encrypt)
goto clean_exit;
}
}
sk_X509_push(recipcerts, cert);
if (sk_X509_push(recipcerts, cert) <= 0) {
X509_free(cert);
goto clean_exit;
}
}

/* sanity check the cipher */
Expand Down Expand Up @@ -6424,7 +6444,10 @@ PHP_FUNCTION(openssl_cms_encrypt)
goto clean_exit;
}
}
sk_X509_push(recipcerts, cert);
if (sk_X509_push(recipcerts, cert) <= 0) {
php_openssl_store_errors();
goto clean_exit;
}
} ZEND_HASH_FOREACH_END();
} else {
/* a single certificate */
Expand All @@ -6444,7 +6467,10 @@ PHP_FUNCTION(openssl_cms_encrypt)
goto clean_exit;
}
}
sk_X509_push(recipcerts, cert);
if (sk_X509_push(recipcerts, cert) <= 0) {
php_openssl_store_errors();
goto clean_exit;
}
}

/* sanity check the cipher */
Expand Down
Loading