don't segfault if given invalid/empty private key

diff --git a/ext/phar/util.c b/ext/phar/util.c
index add7ce8d160741a2a49f2a5ff0d2ef566e7a93dc..909f4053aa84a9e2acae5458ce799988094984a1 100644 (file)
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@ -1902,6 +1902,13 @@ int phar_create_signature(phar_archive_data *phar, php_stream *fp, char **signat
                        key = PEM_read_bio_PrivateKey(in, NULL,NULL, "");
 
                        BIO_free(in);
+                       if (!key) {
+                               if (error) {
+                                       spprintf(error, 0, "unable to process private key");
+                               }
+                               return FAILURE;
+                       }
+
                        siglen = EVP_PKEY_size(key);
                        sigbuf = emalloc(siglen + 1);