diff options
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/openssl/openssl.c | 5 | ||||
| -rw-r--r-- | ext/openssl/tests/openssl_encrypt_ccm.phpt | 12 |
2 files changed, 13 insertions, 4 deletions
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 30d984c300..8cf294b361 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -6546,7 +6546,10 @@ static int php_openssl_cipher_init(const EVP_CIPHER *cipher_type, return FAILURE; } if (mode->is_single_run_aead && enc) { - EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_set_tag_flag, tag_len, NULL); + if (!EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_set_tag_flag, tag_len, NULL)) { + php_error_docref(NULL, E_WARNING, "Setting tag length for AEAD cipher failed"); + return FAILURE; + } } else if (!enc && tag && tag_len > 0) { if (!mode->is_aead) { php_error_docref(NULL, E_WARNING, "The tag cannot be used because the cipher method does not support AEAD"); diff --git a/ext/openssl/tests/openssl_encrypt_ccm.phpt b/ext/openssl/tests/openssl_encrypt_ccm.phpt index c8610bc96b..fb5dbbc849 100644 --- a/ext/openssl/tests/openssl_encrypt_ccm.phpt +++ b/ext/openssl/tests/openssl_encrypt_ccm.phpt @@ -24,9 +24,12 @@ foreach ($tests as $idx => $test) { // Empty IV error var_dump(openssl_encrypt('data', $method, 'password', 0, NULL, $tag, '')); -// Test setting different IV length and unlimeted tag -var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 10), $tag, '', 1024)); +// Test setting different IV length and tag length +var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 10), $tag, '', 14)); var_dump(strlen($tag)); + +// Test setting invalid tag length +var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 16), $tag, '', 1024)); ?> --EXPECTF-- TEST 0 @@ -36,4 +39,7 @@ bool(true) Warning: openssl_encrypt(): Setting of IV length for AEAD mode failed in %s on line %d bool(false) string(8) "p/lvgA==" -int(1024) +int(14) + +Warning: openssl_encrypt(): Setting of IV length for AEAD mode failed in %s on line %d +bool(false) |