The issue remains in the current PHP 5.4 release.

PHP 5.4.0-ZS5.6.0 (cli) (built: Feb 19 2012 10:30:28) 
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies
    with Zend Extension Manager v5.1, Copyright (c) 2003-2010, by Zend Technologies
    - with Zend Data Cache v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Download Server v1.5.0, Copyright (c) 1998-2010 Zend Technologies Ltd., by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Job Queue v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [not licensed] [disabled]
    - with Zend Session Clustering v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Utils v1.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [enabled]
    - with Zend Optimizer+ v4.1, Copyright (c) 1999-2010, by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Code Tracing v1.0, Copyright (c) 2009-2010, by Zend Technologies [loaded] [not licensed] [disabled]
    - with Zend Debugger v5.3, Copyright (c) 1999-2010, by Zend Technologies [loaded] [licensed] [enabled]
    - with Zend Page Cache v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [disabled]


[14.08.2012 14:00:27 ERROR] [ ZendExtensionManager.cpp : 657 ( sig_handler ) ] ZendExtensionManager got SIG 11 at pid 32160 ! 
[14.08.2012 14:00:27 ERROR] [ ZendExtensionManager.cpp : 670 ( sig_handler ) ] Crash happened during IDLE stage 
[14.08.2012 14:00:27 ERROR] [ ZendExtensionManager.cpp : 673 ( sig_handler ) ] The stack trace follows: 
[14.08.2012 14:00:27 SYSTEM] Obtained 18 stack frames 
[14.08.2012 14:00:27 SYSTEM] /usr/local/zend/lib/ZendExtensionManager.so(+0x2b439) [0x7f9bbf15f439] 
[14.08.2012 14:00:27 SYSTEM] /usr/local/zend/lib/ZendExtensionManager.so(+0x17ce4) [0x7f9bbf14bce4] 
[14.08.2012 14:00:27 SYSTEM] /lib/x86_64-linux-gnu/libc.so.6(+0x364c0) [0x7f9bbfaf64c0] 
[14.08.2012 14:00:27 SYSTEM] /lib/x86_64-linux-gnu/libc.so.6(+0x8b560) [0x7f9bbfb4b560] 
[14.08.2012 14:00:27 SYSTEM] php(SHA1_Update+0x13e) [0x79620e] 
[14.08.2012 14:00:27 SYSTEM] php() [0x7bedf7] 
[14.08.2012 14:00:27 SYSTEM] php() [0x7be766] 
[14.08.2012 14:00:27 SYSTEM] php(EVP_SealInit+0x14f) [0x76672f] 
[14.08.2012 14:00:27 SYSTEM] php() [0x499c33] 
[14.08.2012 14:00:27 SYSTEM] php() [0x6af2e5] 
[14.08.2012 14:00:27 SYSTEM] php(execute+0x1ce) [0x6b527e] 
[14.08.2012 14:00:27 SYSTEM] /usr/local/zend/lib/debugger/php-5.4.x/ZendDebugger.so(+0xed85) [0x7f9bb1868d85] 
[14.08.2012 14:00:27 SYSTEM] php(zend_execute_scripts+0x159) [0x681649] 
[14.08.2012 14:00:27 SYSTEM] php(php_execute_script+0x1b8) [0x624718] 
[14.08.2012 14:00:27 SYSTEM] php() [0x728370] 
[14.08.2012 14:00:27 SYSTEM] php() [0x728921] 
[14.08.2012 14:00:27 SYSTEM] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed) [0x7f9bbfae176d] 
[14.08.2012 14:00:27 SYSTEM] php() [0x462cea] 
Segmentation fault (core dumped)

Updated PHP and Ubuntu versions

This guy seems to be doing it in C/C++ with openssl so it should be possible

http://shanetully.com/2012/06/openssl-rsa-aes-and-c-oh-my/

int ServerCrypto::rsaEncrypt(const char *msg, size_t msgLen, unsigned char **encMsg) {
    size_t encMsgLen = 0;
    size_t blockLen  = 0;
    *encMsg = (unsigned char*)malloc(EVP_PKEY_size(clientPubKey));
    if(encMsg == NULL) return FAILURE;
 
    if(!EVP_SealInit(rsaEncryptCtx, EVP_aes_128_cbc(), &rsaSymKey, &rsaSymKeyLen, rsaIV, &clientPubKey, 1)) {
        return FAILURE;
    }
 
    if(!EVP_SealUpdate(rsaEncryptCtx, *encMsg + encMsgLen, (int*)&blockLen, (const unsigned char*)msg, (int)msgLen)) {
        return FAILURE;
    }
    encMsgLen += blockLen;
 
    if(!EVP_SealFinal(rsaEncryptCtx, *encMsg + encMsgLen, (int*)&blockLen)) {
        return FAILURE;
    }
    encMsgLen += blockLen;
 
    EVP_CIPHER_CTX_cleanup(rsaEncryptCtx);
 
    return (int)encMsgLen;
}

When AES is used, EVP_OpenInit() will try to write the IV to allocated memory. In the current version that memory address was set to NULL. 

I've solved the issue by introducing a new &$iv parameter which will hold the IV if an IV cipher is used. I've also added an $iv parameter to openssl_open() to be compatible. 

Let me know if anything is missing.

Jorrit Kronjee

I'll have to try it out sometime. The project was deployed 2 years ago with execing command line tools as a last resort.

Apparently PHP doesn't really care about AES support much. Thanks for looking into it though.

This persists in PHP 5.6.10.

There appear to be some commented out code in the source that attempted to set up some stuff for adding the initialization vector but the call still just passes NULL in for what should be the pointer to the IV (unsigned char *).

I have to say I was quite surprised to see that this hasn't been resolved yet.

I think that the patch looks reasonable. I'm just pinging internals if it's ok for 5.6 (it adds new param...). If so, I will test it, merge it and then port it to 7 as well. If not I will just disable IV ciphers for 5.6 to prevent segfualt. 

There might be is a small concern with locking issue on TS Win as EVP_SealInit uses RAND_bytes but it's already case for some already used parts (e.g. gen params for new pkey) so don't think it should be a blocker here.

Just a quick update. The closing fix is just fixing the segfualt and it went to 5.6. 

I opened a new FR for adding a an IV param because it is out of scope and can be added only to 7 (it's a new param...)

https://bugs.php.net/bug.php?id=70438

That has been fixed in http://git.php.net/?p=php-src.git;a=commit;h=e235cb65fbb2b16eb6ee35c0786d9f42f1a74e2c and you will be able to use IV cipher algs in PHP 7.