You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The error happens when the PEM contains a public key, as it will be first tried to be parsed as a certificate (see here). The parsing as a certificate fails, which then leads to a corresponding error tracked by PHP with the next call to php_openssl_store_errors().
As PHP handles the case where the certificate cannot be parsed, consequentially this error should never reach the user. Else the user-code would need to ignore this error somehow, which requires knowledge of implementation details when this is safe to do, and when not.
Solution
I see two ways how to fix the issue.
Prevent error being stored
The error should never reach PHP's OPENSSL_G(errors) buffer. Prevent php_openssl_x509_from_str to store the errors, and discard them in php_openssl_pkey_from_zval.
I'll create a PR shortly for this second version. I feel it is less intrusive and simpler to understand. Let me know if you have a different option on this, and I'll update the PR.
PHP Version
PHP 8.0.28, PHP 8.1.17, PHP 8.2.4
Operating System
No response
The text was updated successfully, but these errors were encountered:
Description
The following code:
Resulted in this output:
But I expected this output instead:
Note that
openssl_get_publickey
succeeded; the error is there nonetheless. More elaborate test cases here: https://github.com/famoser/polyas-verification/blob/a28f16437ab695548b3cb301258f87badf7aee69/tests/Utils/OpenSSLBugs.phpAnalysis
The error happens when the PEM contains a public key, as it will be first tried to be parsed as a certificate (see here). The parsing as a certificate fails, which then leads to a corresponding error tracked by PHP with the next call to
php_openssl_store_errors()
.As PHP handles the case where the certificate cannot be parsed, consequentially this error should never reach the user. Else the user-code would need to ignore this error somehow, which requires knowledge of implementation details when this is safe to do, and when not.
Solution
I see two ways how to fix the issue.
Prevent error being stored
The error should never reach PHP's
OPENSSL_G(errors)
buffer. Preventphp_openssl_x509_from_str
to store the errors, and discard them inphp_openssl_pkey_from_zval
.Pseudo-code:
Mark & Revert error
Similar to how openSSL error buffer works, introduce an option to mark the buffer at a specific state, and allow to revert to this state.
Pseudo-code:
I'll create a PR shortly for this second version. I feel it is less intrusive and simpler to understand. Let me know if you have a different option on this, and I'll update the PR.
PHP Version
PHP 8.0.28, PHP 8.1.17, PHP 8.2.4
Operating System
No response
The text was updated successfully, but these errors were encountered: