php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #60632 openssl_seal fails with AES
Submitted: 2011-12-31 20:15 UTC Modified: 2015-09-06 18:19 UTC
Votes:9
Avg. Score:4.7 ± 0.5
Reproduced:9 of 9 (100.0%)
Same Version:3 (33.3%)
Same OS:1 (11.1%)
From: brett at silcon dot com Assigned: bukka (profile)
Status: Closed Package: OpenSSL related
PHP Version: 5.4.0-ZS5.6.0 OS: Ubuntu 12.04 LTS
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: brett at silcon dot com
New email:
PHP Version: OS:

 

 [2011-12-31 20:15 UTC] brett at silcon dot com 
Description:
------------
The following test script segfaults in both PHP 5.3.8 and PHP 5.4.0RC4 even 
though OpenSSL is supposed to support AES in PHP 5.4.0.

In the attached script running with method 'aes256' or 'AES-256-CFB' both 
segfault.

PHP 5.4.0 just prints a segfault, but in my PHP 5.3.8 from Zend Server, it prints 
a full printout first.

I don't know if this is an expected wontfix or if its a genuinely overlooked 
item.

Test script:
---------------
<?php
$pkey = openssl_pkey_new(array(
             'digest_alg' => 'sha256',
             'x509_extensions' => 'v3_ca',
             'private_key_bits' => 4096,
             'private_key_type' => OPENSSL_KEYTYPE_RSA,
             'encrypt_key' => false
         ));
$details = openssl_pkey_get_details($pkey);
$Tpubkey = $details['key'];
$pubkey = openssl_pkey_get_public($Tpubkey);
$encrypted = null;
$ekeys = array();
$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'aes256');
//$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CFB');


Expected result:
----------------
I would expect encrypted text placed in $encrypted and AES encrypted session keys 
placed in $ekeys.


Actual result:
--------------
PHP 5.4.0
blt@php54:~$ php-5.4.0RC4/sapi/cli/php phpsealtest.php 
Segmentation fault


PHP 5.3.8

blt@aurora:~$ /usr/local/zend/bin/php phpsealtest.php 
[31.12.2011 14:14:29 ERROR] [ ZendExtensionManager.cpp : 661 ( sig_handler ) ] 
ZendExtensionManager got SIG 11 at pid 1583 ! 
[31.12.2011 14:14:29 ERROR] [ ZendExtensionManager.cpp : 674 ( sig_handler ) ] 
Crash happened during IDLE stage 
[31.12.2011 14:14:29 ERROR] [ ZendExtensionManager.cpp : 677 ( sig_handler ) ] 
The stack trace follows: 
[31.12.2011 14:14:29 SYSTEM] Obtained 17 stack frames 
[31.12.2011 14:14:29 SYSTEM] 
/usr/local/zend/lib/ZendExtensionManager.so(+0x28df5) [0x7f62e378fdf5] 
[31.12.2011 14:14:29 SYSTEM] 
/usr/local/zend/lib/ZendExtensionManager.so(+0x1724a) [0x7f62e377e24a] 
[31.12.2011 14:14:29 SYSTEM] /lib/libc.so.6(+0x33af0) [0x7f62e3c81af0] 
[31.12.2011 14:14:29 SYSTEM] /lib/libc.so.6(memcpy+0x1e) [0x7f62e3cd4cae] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php(SHA1_Update+0x13e) 
[0x75ca2e] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php() [0x7833f7] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php() [0x782d66] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php(EVP_SealInit+0x14f) 
[0x72cc0f] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php() [0x498893] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php() [0x692c93] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php(execute+0x1d3) [0x692293] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/lib/debugger/php-
5.3.x/ZendDebugger.so(+0xed9b) [0x7f62d866fd9b] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php(zend_execute_scripts+0x159) 
[0x66bae9] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php(php_execute_script+0x1b8) 
[0x619968] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php() [0x6f5b94] 
[31.12.2011 14:14:29 SYSTEM] /lib/libc.so.6(__libc_start_main+0xfd) 
[0x7f62e3c6cc4d] 
[31.12.2011 14:14:29 SYSTEM] /usr/local/zend/bin/php() [0x4614aa] 
Segmentation fault

Patches

bug60632_new_parameter_for_iv_ciphers.patch (last revision 2013-11-10 21:18 UTC by jorrit at wafel dot org)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-08-14 19:01 UTC] brett at silcon dot com 
The issue remains in the current PHP 5.4 release.

PHP 5.4.0-ZS5.6.0 (cli) (built: Feb 19 2012 10:30:28) 
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies
    with Zend Extension Manager v5.1, Copyright (c) 2003-2010, by Zend Technologies
    - with Zend Data Cache v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Download Server v1.5.0, Copyright (c) 1998-2010 Zend Technologies Ltd., by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Job Queue v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [not licensed] [disabled]
    - with Zend Session Clustering v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Utils v1.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [enabled]
    - with Zend Optimizer+ v4.1, Copyright (c) 1999-2010, by Zend Technologies [loaded] [licensed] [disabled]
    - with Zend Code Tracing v1.0, Copyright (c) 2009-2010, by Zend Technologies [loaded] [not licensed] [disabled]
    - with Zend Debugger v5.3, Copyright (c) 1999-2010, by Zend Technologies [loaded] [licensed] [enabled]
    - with Zend Page Cache v4.0, Copyright (c) 2004-2010, by Zend Technologies [loaded] [licensed] [disabled]


[14.08.2012 14:00:27 ERROR] [ ZendExtensionManager.cpp : 657 ( sig_handler ) ] ZendExtensionManager got SIG 11 at pid 32160 ! 
[14.08.2012 14:00:27 ERROR] [ ZendExtensionManager.cpp : 670 ( sig_handler ) ] Crash happened during IDLE stage 
[14.08.2012 14:00:27 ERROR] [ ZendExtensionManager.cpp : 673 ( sig_handler ) ] The stack trace follows: 
[14.08.2012 14:00:27 SYSTEM] Obtained 18 stack frames 
[14.08.2012 14:00:27 SYSTEM] /usr/local/zend/lib/ZendExtensionManager.so(+0x2b439) [0x7f9bbf15f439] 
[14.08.2012 14:00:27 SYSTEM] /usr/local/zend/lib/ZendExtensionManager.so(+0x17ce4) [0x7f9bbf14bce4] 
[14.08.2012 14:00:27 SYSTEM] /lib/x86_64-linux-gnu/libc.so.6(+0x364c0) [0x7f9bbfaf64c0] 
[14.08.2012 14:00:27 SYSTEM] /lib/x86_64-linux-gnu/libc.so.6(+0x8b560) [0x7f9bbfb4b560] 
[14.08.2012 14:00:27 SYSTEM] php(SHA1_Update+0x13e) [0x79620e] 
[14.08.2012 14:00:27 SYSTEM] php() [0x7bedf7] 
[14.08.2012 14:00:27 SYSTEM] php() [0x7be766] 
[14.08.2012 14:00:27 SYSTEM] php(EVP_SealInit+0x14f) [0x76672f] 
[14.08.2012 14:00:27 SYSTEM] php() [0x499c33] 
[14.08.2012 14:00:27 SYSTEM] php() [0x6af2e5] 
[14.08.2012 14:00:27 SYSTEM] php(execute+0x1ce) [0x6b527e] 
[14.08.2012 14:00:27 SYSTEM] /usr/local/zend/lib/debugger/php-5.4.x/ZendDebugger.so(+0xed85) [0x7f9bb1868d85] 
[14.08.2012 14:00:27 SYSTEM] php(zend_execute_scripts+0x159) [0x681649] 
[14.08.2012 14:00:27 SYSTEM] php(php_execute_script+0x1b8) [0x624718] 
[14.08.2012 14:00:27 SYSTEM] php() [0x728370] 
[14.08.2012 14:00:27 SYSTEM] php() [0x728921] 
[14.08.2012 14:00:27 SYSTEM] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed) [0x7f9bbfae176d] 
[14.08.2012 14:00:27 SYSTEM] php() [0x462cea] 
Segmentation fault (core dumped)
 [2012-08-14 19:02 UTC] brett at silcon dot com 
Updated PHP and Ubuntu versions
 [2012-08-14 19:02 UTC] brett at silcon dot com
-Operating System: Ubuntu 10.04 LTS +Operating System: Ubuntu 12.04 LTS -PHP Version: 5.4.0RC4 +PHP Version: 5.4.0-ZS5.6.0
 [2012-08-14 19:11 UTC] brett at Silcon dot com 
This guy seems to be doing it in C/C++ with openssl so it should be possible

http://shanetully.com/2012/06/openssl-rsa-aes-and-c-oh-my/

int ServerCrypto::rsaEncrypt(const char *msg, size_t msgLen, unsigned char **encMsg) {
    size_t encMsgLen = 0;
    size_t blockLen  = 0;
    *encMsg = (unsigned char*)malloc(EVP_PKEY_size(clientPubKey));
    if(encMsg == NULL) return FAILURE;
 
    if(!EVP_SealInit(rsaEncryptCtx, EVP_aes_128_cbc(), &rsaSymKey, &rsaSymKeyLen, rsaIV, &clientPubKey, 1)) {
        return FAILURE;
    }
 
    if(!EVP_SealUpdate(rsaEncryptCtx, *encMsg + encMsgLen, (int*)&blockLen, (const unsigned char*)msg, (int)msgLen)) {
        return FAILURE;
    }
    encMsgLen += blockLen;
 
    if(!EVP_SealFinal(rsaEncryptCtx, *encMsg + encMsgLen, (int*)&blockLen)) {
        return FAILURE;
    }
    encMsgLen += blockLen;
 
    EVP_CIPHER_CTX_cleanup(rsaEncryptCtx);
 
    return (int)encMsgLen;
}
 [2013-11-10 21:15 UTC] jorrit at wafel dot org 
When AES is used, EVP_OpenInit() will try to write the IV to allocated memory. In the current version that memory address was set to NULL. 

I've solved the issue by introducing a new &$iv parameter which will hold the IV if an IV cipher is used. I've also added an $iv parameter to openssl_open() to be compatible. 

Let me know if anything is missing.

Jorrit Kronjee
 [2013-11-18 02:25 UTC] brett at silcon dot com 
I'll have to try it out sometime. The project was deployed 2 years ago with execing command line tools as a last resort.

Apparently PHP doesn't really care about AES support much. Thanks for looking into it though.
 [2015-06-22 21:57 UTC] calebbegly at gmail dot com 
This persists in PHP 5.6.10.

There appear to be some commented out code in the source that attempted to set up some stuff for adding the initialization vector but the call still just passes NULL in for what should be the pointer to the IV (unsigned char *).

I have to say I was quite surprised to see that this hasn't been resolved yet.
 [2015-08-30 18:42 UTC] bukka@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: bukka
 [2015-08-30 18:42 UTC] bukka@php.net 
I think that the patch looks reasonable. I'm just pinging internals if it's ok for 5.6 (it adds new param...). If so, I will test it, merge it and then port it to 7 as well. If not I will just disable IV ciphers for 5.6 to prevent segfualt. 

There might be is a small concern with locking issue on TS Win as EVP_SealInit uses RAND_bytes but it's already case for some already used parts (e.g. gen params for new pkey) so don't think it should be a blocker here.
 [2015-09-01 00:49 UTC] cmb@php.net 
Related To: Bug #70329
 [2015-09-06 15:40 UTC] bukka@php.net 
Automatic comment on behalf of bukka
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d47029167dfc2184f9a630a75a55e145bff8b017
Log: Fix bug #60632: openssl_seal fails with AES
 [2015-09-06 15:40 UTC] bukka@php.net
-Status: Assigned +Status: Closed
 [2015-09-06 15:51 UTC] bukka@php.net 
Automatic comment on behalf of bukka
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d47029167dfc2184f9a630a75a55e145bff8b017
Log: Fix bug #60632: openssl_seal fails with AES
 [2015-09-06 18:19 UTC] bukka@php.net 
Just a quick update. The closing fix is just fixing the segfualt and it went to 5.6. 

I opened a new FR for adding a an IV param because it is out of scope and can be added only to 7 (it's a new param...)

https://bugs.php.net/bug.php?id=70438

That has been fixed in http://git.php.net/?p=php-src.git;a=commit;h=e235cb65fbb2b16eb6ee35c0786d9f42f1a74e2c and you will be able to use IV cipher algs in PHP 7.
 [2015-09-15 12:13 UTC] ab@php.net 
Automatic comment on behalf of bukka
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d47029167dfc2184f9a630a75a55e145bff8b017
Log: Fix bug #60632: openssl_seal fails with AES
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 12:01:29 2024 UTC