php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #64133 overflow in PHP_FUNCTION(openssl_csr_sign)
Submitted: 2013-02-02 15:34 UTC Modified: 2013-02-03 11:55 UTC
From: alex at hollerith dot net Assigned:
Status: Not a bug Package: OpenSSL related
PHP Version: master-Git-2013-02-02 (Git) OS: FreeBSD i386
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: alex at hollerith dot net
New email:
PHP Version: OS:

 

 [2013-02-02 15:34 UTC] alex at hollerith dot net 
Description:
------------
Potential overflow in this code:

/* {{{ proto resource openssl_csr_sign(mixed csr, mixed x509, mixed priv_key, long 
days [, array config_args [, long serial]])
   Signs a cert with another CERT */
PHP_FUNCTION(openssl_csr_sign)
{
   zval ** zcert = NULL, **zcsr, **zpkey, *args = NULL;
   long num_days;
......
       X509_gmtime_adj(X509_get_notAfter(new_cert), (long)60*60*24*num_days);
......

When "num_days" is big, say 36500 (for 100 years) this casting to "long" will 
overflow in 32-bit environments where usually "sizeof(long) = 4".

This is relevant for applications like the pfsense Firewall system on embedded 
hardware like the Soekris6501, where only i386 versions can be installed.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-02-02 15:57 UTC] pajoye@php.net 
See http://rt.openssl.org/Ticket/Display.html?id=534

Not an issue in PHP, the signature of X509_gmtime_adj actually expects a long.
 [2013-02-02 15:57 UTC] pajoye@php.net
-Status: Open +Status: Not a bug
 [2013-02-03 11:55 UTC] alex at hollerith dot net 
I've asked on the openssl-users mailinglist and was told that there is a new API 
function in OpenSSL that would be able to work around the problem:

X509_time_adj_ex(X509_get_notAfter(x),days, 0, NULL);

Not sure if you want to make the effort, I suppose it would mean to check for what 
Version of OpenSSL is available and then either call one or the other API function 
- I just thought it might be helpful to have that information here in the ticket.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Jul 02 07:01:33 2025 UTC