From edb8c13b7e5166c28a6c9a42e0b3c950ebcca98f Mon Sep 17 00:00:00 2001 From: Alexander Danilov Date: Tue, 27 Oct 2026 14:48:04 +0200 Subject: [PATCH] Fix GH-24784: openssl_pkcs7_read()/openssl_cms_read() CRLs overwrite certificates The certificate and CRL loops both indexed the output array with their own counter, so each CRL replaced the certificate at the same index. Append with add_next_index_zval() instead. --- NEWS | 2 ++ ext/openssl/openssl.c | 8 ++--- ext/openssl/tests/gh24784.phpt | 57 ++++++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 4 deletions(-) create mode 100644 ext/openssl/tests/gh24784.phpt diff --git a/NEWS b/NEWS index 01556b62951d..c98160c8f321 100644 --- a/NEWS +++ b/NEWS @@ -366,6 +366,8 @@ PHP NEWS after a handshake timeout. (Ilia Alshanetsky) . Fixed feof() on a TLS stream staying false after a close_notify on Windows. (Jakub Zelenka) + . Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite + certificates with CRLs). (Alexander Danilov) - PCNTL: . Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 36d5a7ccb73c..ce0a1656cabb 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -6053,7 +6053,7 @@ PHP_FUNCTION(openssl_pkcs7_read) BUF_MEM *bio_buf; BIO_get_mem_ptr(bio_out, &bio_buf); ZVAL_STRINGL(&zcert, bio_buf->data, bio_buf->length); - add_index_zval(zout, i, &zcert); + add_next_index_zval(zout, &zcert); } BIO_free(bio_out); } @@ -6068,7 +6068,7 @@ PHP_FUNCTION(openssl_pkcs7_read) BUF_MEM *bio_buf; BIO_get_mem_ptr(bio_out, &bio_buf); ZVAL_STRINGL(&zcert, bio_buf->data, bio_buf->length); - add_index_zval(zout, i, &zcert); + add_next_index_zval(zout, &zcert); } BIO_free(bio_out); } @@ -6709,7 +6709,7 @@ PHP_FUNCTION(openssl_cms_read) BUF_MEM *bio_buf; BIO_get_mem_ptr(bio_out, &bio_buf); ZVAL_STRINGL(&zcert, bio_buf->data, bio_buf->length); - add_index_zval(zout, i, &zcert); + add_next_index_zval(zout, &zcert); } BIO_free(bio_out); } @@ -6724,7 +6724,7 @@ PHP_FUNCTION(openssl_cms_read) BUF_MEM *bio_buf; BIO_get_mem_ptr(bio_out, &bio_buf); ZVAL_STRINGL(&zcert, bio_buf->data, bio_buf->length); - add_index_zval(zout, i, &zcert); + add_next_index_zval(zout, &zcert); } BIO_free(bio_out); } diff --git a/ext/openssl/tests/gh24784.phpt b/ext/openssl/tests/gh24784.phpt new file mode 100644 index 000000000000..9cc7e7597bdf --- /dev/null +++ b/ext/openssl/tests/gh24784.phpt @@ -0,0 +1,57 @@ +--TEST-- +GH-24784 (openssl_pkcs7_read()/openssl_cms_read() CRLs overwrite certificates) +--EXTENSIONS-- +openssl +--FILE-- + $pkcs7, 'openssl_cms_read' => $cms] as $func => $data) { + echo $func, "\n"; + var_dump($func($data, $result)); + var_dump(count($result)); + foreach ($result as $i => $pem) { + echo $i, ': ', strtok($pem, "\n"), "\n"; + } +} +?> +--EXPECT-- +openssl_pkcs7_read +bool(true) +int(2) +0: -----BEGIN CERTIFICATE----- +1: -----BEGIN X509 CRL----- +openssl_cms_read +bool(true) +int(2) +0: -----BEGIN CERTIFICATE----- +1: -----BEGIN X509 CRL-----