Fix bug #78079 (openssl_encrypt_ccm.phpt fails with OpenSSL 1.1.1c)

It also fixes invalid setting of tag length

diff --git a/NEWS b/NEWS
index 8478a5ce82cbc06106a30fb7975985ddcf02885c..438c962759ec17879ad25430b67c2183b4c17104 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,10 @@ PHP                                                                        NEWS
   . Fixed bug #77956 (When mysqli.allow_local_infile = Off, use a meaningful
     error message). (Sjon Hortensius)
 
+- OpenSSL:
+  . Fixed bug #78079 (openssl_encrypt_ccm.phpt fails with OpenSSL 1.1.1c).
+    (Jakub Zelenka)
+
 - Sockets:
   . Fixed bug #78038 (Socket_select fails when resource array contains
     references). (Nikita)

diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index 7df50720eb126fe5a285f6a98284e632ef94cf55..91df229c3d45d97398e2afb410c6fb4df0453d3c 100644 (file)
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -6444,7 +6444,10 @@ static int php_openssl_cipher_init(const EVP_CIPHER *cipher_type,
                return FAILURE;
        }
        if (mode->is_single_run_aead && enc) {
-               EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_set_tag_flag, tag_len, NULL);
+               if (!EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_set_tag_flag, tag_len, NULL)) {
+                       php_error_docref(NULL, E_WARNING, "Setting tag length for AEAD cipher failed");
+                       return FAILURE;
+               }
        } else if (!enc && tag && tag_len > 0) {
                if (!mode->is_aead) {
                        php_error_docref(NULL, E_WARNING, "The tag cannot be used because the cipher method does not support AEAD");

diff --git a/ext/openssl/tests/openssl_encrypt_ccm.phpt b/ext/openssl/tests/openssl_encrypt_ccm.phpt
index c8610bc96bc41eb82ccc0eb9803ee746af54856b..fb5dbbc849d06aaf38c5b4c7468fd9bc7c370f80 100644 (file)
--- a/ext/openssl/tests/openssl_encrypt_ccm.phpt
+++ b/ext/openssl/tests/openssl_encrypt_ccm.phpt
@@ -24,9 +24,12 @@ foreach ($tests as $idx => $test) {
 // Empty IV error
 var_dump(openssl_encrypt('data', $method, 'password', 0, NULL, $tag, ''));
 
-// Test setting different IV length and unlimeted tag
-var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 10), $tag, '', 1024));
+// Test setting different IV length and tag length
+var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 10), $tag, '', 14));
 var_dump(strlen($tag));
+
+// Test setting invalid tag length
+var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 16), $tag, '', 1024));
 ?>
 --EXPECTF--
 TEST 0
@@ -36,4 +39,7 @@ bool(true)
 Warning: openssl_encrypt(): Setting of IV length for AEAD mode failed in %s on line %d
 bool(false)
 string(8) "p/lvgA=="
-int(1024)
+int(14)
+
+Warning: openssl_encrypt(): Setting of IV length for AEAD mode failed in %s on line %d
+bool(false)