Fix bug #60632: openssl_seal fails with AES

diff --git a/NEWS b/NEWS
index 0a2103ea3ba9f76071b8fb04b61d95d810d83359..7d4206ee98a3307d1a8eea9ca1a4783d32dc62ac 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ PHP                                                                        NEWS
   . Fixed bug #55259 (openssl extension does not get the DH parameters from 
     DH key resource). (Jakub Zelenka)
   . Fixed bug #70395 (Missing ARG_INFO for openssl_seal()). (cmb)
+  . Fixed bug #60632 (openssl_seal fails with AES). (Jakub Zelenka)
 
 - PDO:
   . Fixed bug #70389 (PDO constructor changes unrelated variables). (Laruence)

diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index cc86f0440f0faf04f6e6a41bac18ee2219880bcf..de5a7d4c58b60de17e81b4698f6f1700919d6540 100644 (file)
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -4871,6 +4871,10 @@ PHP_FUNCTION(openssl_seal)
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
                        RETURN_FALSE;
                }
+               if (EVP_CIPHER_iv_length(cipher) > 0) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Ciphers with modes requiring IV are not supported");
+                       RETURN_FALSE;
+               }
        } else {
                cipher = EVP_rc4();
        }

diff --git a/ext/openssl/tests/bug60632.phpt b/ext/openssl/tests/bug60632.phpt
new file mode 100644 (file)
index 0000000..c718fed
--- /dev/null
+++ b/ext/openssl/tests/bug60632.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #60632: openssl_seal fails with AES
+--SKIPIF--
+<?php
+if (!extension_loaded("openssl")) die("skip openssl not loaded");
+?>
+--FILE--
+<?php
+$pkey = openssl_pkey_new(array(
+       'digest_alg' => 'sha256',
+       'private_key_bits' => 1024,
+       'private_key_type' => OPENSSL_KEYTYPE_RSA,
+       'encrypt_key' => false
+));
+$details = openssl_pkey_get_details($pkey);
+$test_pubkey = $details['key'];
+$pubkey = openssl_pkey_get_public($test_pubkey);
+$encrypted = null;
+$ekeys = array();
+$result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CBC');
+echo "Done";
+?>
+--EXPECTF--
+Warning: openssl_seal(): Ciphers with modes requiring IV are not supported in %s on line %d
+Done