php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #64133 overflow in PHP_FUNCTION(openssl_csr_sign)
Submitted: 2013-02-02 15:34 UTC Modified: 2013-02-03 11:55 UTC
From: alex at hollerith dot net Assigned:
Status: Not a bug Package: OpenSSL related
PHP Version: master-Git-2013-02-02 (Git) OS: FreeBSD i386
Private report: No CVE-ID: None
View Developer Edit
 [2013-02-02 15:34 UTC] alex at hollerith dot net 
Description:
------------
Potential overflow in this code:

/* {{{ proto resource openssl_csr_sign(mixed csr, mixed x509, mixed priv_key, long 
days [, array config_args [, long serial]])
   Signs a cert with another CERT */
PHP_FUNCTION(openssl_csr_sign)
{
   zval ** zcert = NULL, **zcsr, **zpkey, *args = NULL;
   long num_days;
......
       X509_gmtime_adj(X509_get_notAfter(new_cert), (long)60*60*24*num_days);
......

When "num_days" is big, say 36500 (for 100 years) this casting to "long" will 
overflow in 32-bit environments where usually "sizeof(long) = 4".

This is relevant for applications like the pfsense Firewall system on embedded 
hardware like the Soekris6501, where only i386 versions can be installed.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-02-02 15:57 UTC] pajoye@php.net 
See http://rt.openssl.org/Ticket/Display.html?id=534

Not an issue in PHP, the signature of X509_gmtime_adj actually expects a long.
 [2013-02-02 15:57 UTC] pajoye@php.net
-Status: Open +Status: Not a bug
 [2013-02-03 11:55 UTC] alex at hollerith dot net 
I've asked on the openssl-users mailinglist and was told that there is a new API 
function in OpenSSL that would be able to work around the problem:

X509_time_adj_ex(X509_get_notAfter(x),days, 0, NULL);

Not sure if you want to make the effort, I suppose it would mean to check for what 
Version of OpenSSL is available and then either call one or the other API function 
- I just thought it might be helpful to have that information here in the ticket.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Mon Nov 17 05:00:01 2025 UTC