|
 |
2067da |
diff -up php-5.4.16/ext/openssl/openssl.c.cve6420 php-5.4.16/ext/openssl/openssl.c
|
|
|
2067da |
--- php-5.4.16/ext/openssl/openssl.c.cve6420 2013-12-06 07:05:06.870106576 +0100
|
|
|
2067da |
+++ php-5.4.16/ext/openssl/openssl.c 2013-12-06 07:05:06.872106575 +0100
|
|
|
2067da |
@@ -656,18 +656,28 @@ static time_t asn1_time_to_time_t(ASN1_U
|
|
|
2067da |
char * thestr;
|
|
|
2067da |
long gmadjust = 0;
|
|
|
2067da |
|
|
|
2067da |
- if (timestr->length < 13) {
|
|
|
2067da |
+ if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) {
|
|
|
2067da |
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp");
|
|
|
2067da |
+ return (time_t)-1;
|
|
|
2067da |
+ }
|
|
|
2067da |
+
|
|
|
2067da |
+ if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
|
|
|
2067da |
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
|
|
|
2067da |
+ return (time_t)-1;
|
|
|
2067da |
+ }
|
|
|
2067da |
+
|
|
|
2067da |
+ if (ASN1_STRING_length(timestr) < 13) {
|
|
|
2067da |
php_error_docref(NULL TSRMLS_CC, E_WARNING, "extension author too lazy to parse %s correctly", timestr->data);
|
|
|
2067da |
return (time_t)-1;
|
|
|
2067da |
}
|
|
|
2067da |
|
|
|
2067da |
- strbuf = estrdup((char *)timestr->data);
|
|
|
2067da |
+ strbuf = estrdup((char *)ASN1_STRING_data(timestr));
|
|
|
2067da |
|
|
|
2067da |
memset(&thetime, 0, sizeof(thetime));
|
|
|
2067da |
|
|
|
2067da |
/* we work backwards so that we can use atoi more easily */
|
|
|
2067da |
|
|
|
2067da |
- thestr = strbuf + timestr->length - 3;
|
|
|
2067da |
+ thestr = strbuf + ASN1_STRING_length(timestr) - 3;
|
|
|
2067da |
|
|
|
2067da |
thetime.tm_sec = atoi(thestr);
|
|
|
2067da |
*thestr = '\0';
|
|
|
2067da |
diff -up php-5.4.16/ext/openssl/tests/cve-2013-6420.crt.cve6420 php-5.4.16/ext/openssl/tests/cve-2013-6420.crt
|
|
|
2067da |
--- php-5.4.16/ext/openssl/tests/cve-2013-6420.crt.cve6420 2013-12-06 07:05:06.872106575 +0100
|
|
|
2067da |
+++ php-5.4.16/ext/openssl/tests/cve-2013-6420.crt 2013-12-06 07:05:06.872106575 +0100
|
|
|
2067da |
@@ -0,0 +1,29 @@
|
|
|
2067da |
+-----BEGIN CERTIFICATE-----
|
|
|
2067da |
+MIIEpDCCA4ygAwIBAgIJAJzu8r6u6eBcMA0GCSqGSIb3DQEBBQUAMIHDMQswCQYD
|
|
|
2067da |
+VQQGEwJERTEcMBoGA1UECAwTTm9yZHJoZWluLVdlc3RmYWxlbjEQMA4GA1UEBwwH
|
|
|
2067da |
+S8ODwrZsbjEUMBIGA1UECgwLU2VrdGlvbkVpbnMxHzAdBgNVBAsMFk1hbGljaW91
|
|
|
2067da |
+cyBDZXJ0IFNlY3Rpb24xITAfBgNVBAMMGG1hbGljaW91cy5zZWt0aW9uZWlucy5k
|
|
|
2067da |
+ZTEqMCgGCSqGSIb3DQEJARYbc3RlZmFuLmVzc2VyQHNla3Rpb25laW5zLmRlMHUY
|
|
|
2067da |
+ZDE5NzAwMTAxMDAwMDAwWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
|
2067da |
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
|
2067da |
+AAAAAAAXDTE0MTEyODExMzkzNVowgcMxCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNO
|
|
|
2067da |
+b3JkcmhlaW4tV2VzdGZhbGVuMRAwDgYDVQQHDAdLw4PCtmxuMRQwEgYDVQQKDAtT
|
|
|
2067da |
+ZWt0aW9uRWluczEfMB0GA1UECwwWTWFsaWNpb3VzIENlcnQgU2VjdGlvbjEhMB8G
|
|
|
2067da |
+A1UEAwwYbWFsaWNpb3VzLnNla3Rpb25laW5zLmRlMSowKAYJKoZIhvcNAQkBFhtz
|
|
|
2067da |
+dGVmYW4uZXNzZXJAc2VrdGlvbmVpbnMuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IB
|
|
|
2067da |
+DwAwggEKAoIBAQDDAf3hl7JY0XcFniyEJpSSDqn0OqBr6QP65usJPRt/8PaDoqBu
|
|
|
2067da |
+wEYT/Na+6fsgPjC0uK9DZgWg2tHWWoanSblAMoz5PH6Z+S4SHRZ7e2dDIjPjdhjh
|
|
|
2067da |
+0mLg2UMO5yp0V797Ggs9lNt6JRfH81MN2obXWs4NtztLMuD6egqpr8dDbr34aOs8
|
|
|
2067da |
+pkdui5UawTZksy5pLPHq5cMhFGm06v65CLo0V2Pd9+KAokPrPcN5KLKebz7mLpk6
|
|
|
2067da |
+SMeEXOKP4idEqxyQ7O7fBuHMedsQhu+prY3si3BUyKfQtP5CZnX2bp0wKHxX12DX
|
|
|
2067da |
+1nfFIt9DbGvHTcyOuN+nZLPBm3vWxntyIIvVAgMBAAGjQjBAMAkGA1UdEwQCMAAw
|
|
|
2067da |
+EQYJYIZIAYb4QgEBBAQDAgeAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEF
|
|
|
2067da |
+BQcDAjANBgkqhkiG9w0BAQUFAAOCAQEAG0fZYYCTbdj1XYc+1SnoaPR+vI8C8CaD
|
|
|
2067da |
+8+0UYhdnyU4gga0BAcDrY9e94eEAu6ZqycF6FjLqXXdAboppWocr6T6GD1x33Ckl
|
|
|
2067da |
+VArzG/KxQohGD2JeqkhIMlDomxHO7ka39+Oa8i2vWLVyjU8AZvWMAruHa4EENyG7
|
|
|
2067da |
+lW2AagaFKFCr9TnXTfrdxGVEbv7KVQ6bdhg5p5SjpWH1+Mq03uR3ZXPBYdyV8319
|
|
|
2067da |
+o0lVj1KFI2DCL/liWisJRoof+1cR35Ctd0wYBcpB6TZslMcOPl76dwKwJgeJo2Qg
|
|
|
2067da |
+Zsfmc2vC1/qOlNuNq/0TzzkVGv8ETT3CgaU+UXe4XOVvkccebJn2dg==
|
|
|
2067da |
+-----END CERTIFICATE-----
|
|
|
2067da |
+
|
|
|
2067da |
+
|
|
|
2067da |
diff -up php-5.4.16/ext/openssl/tests/cve-2013-6420.phpt.cve6420 php-5.4.16/ext/openssl/tests/cve-2013-6420.phpt
|
|
|
2067da |
--- php-5.4.16/ext/openssl/tests/cve-2013-6420.phpt.cve6420 2013-12-06 07:05:06.872106575 +0100
|
|
|
2067da |
+++ php-5.4.16/ext/openssl/tests/cve-2013-6420.phpt 2013-12-06 07:05:06.872106575 +0100
|
|
|
2067da |
@@ -0,0 +1,18 @@
|
|
|
2067da |
+--TEST--
|
|
|
2067da |
+CVE-2013-6420
|
|
|
2067da |
+--SKIPIF--
|
|
|
2067da |
+
|
|
|
2067da |
+if (!extension_loaded("openssl")) die("skip");
|
|
|
2067da |
+?>
|
|
|
2067da |
+--FILE--
|
|
|
2067da |
+
|
|
|
2067da |
+$crt = substr(__FILE__, 0, -4).'.crt';
|
|
|
2067da |
+$info = openssl_x509_parse("file://$crt");
|
|
|
2067da |
+var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
|
|
|
2067da |
+?>
|
|
|
2067da |
+Done
|
|
|
2067da |
+--EXPECTF--
|
|
|
2067da |
+%s openssl_x509_parse(): illegal ASN1 data type for timestamp in %s/cve-2013-6420.php on line 3
|
|
|
2067da |
+string(27) "stefan.esser@sektioneins.de"
|
|
|
2067da |
+int(-1)
|
|
|
2067da |
+Done
|