@@ -615,7 +615,7 @@ static void add_assoc_name_entry(zval * val, char * key, X509_NAME * name, int s
615
615
616
616
for (i = 0 ; i < X509_NAME_entry_count (name ); i ++ ) {
617
617
unsigned char * to_add ;
618
- int to_add_len ;
618
+ int to_add_len = 0 ;
619
619
620
620
621
621
ne = X509_NAME_get_entry (name , i );
@@ -1529,7 +1529,6 @@ PHP_FUNCTION(openssl_spki_export)
1529
1529
EVP_PKEY * pkey = NULL ;
1530
1530
NETSCAPE_SPKI * spki = NULL ;
1531
1531
BIO * out = BIO_new (BIO_s_mem ());
1532
- BUF_MEM * bio_buf ;
1533
1532
1534
1533
if (zend_parse_parameters (ZEND_NUM_ARGS () TSRMLS_CC , "s" , & spkstr , & spkstr_len ) == FAILURE ) {
1535
1534
return ;
@@ -1710,6 +1709,74 @@ PHP_FUNCTION(openssl_x509_check_private_key)
1710
1709
}
1711
1710
/* }}} */
1712
1711
1712
+ /* Special handling of subjectAltName, see CVE-2013-4073
1713
+ * Christian Heimes
1714
+ */
1715
+
1716
+ static int openssl_x509v3_subjectAltName (BIO * bio , X509_EXTENSION * extension )
1717
+ {
1718
+ GENERAL_NAMES * names ;
1719
+ const X509V3_EXT_METHOD * method = NULL ;
1720
+ long i , length , num ;
1721
+ const unsigned char * p ;
1722
+
1723
+ method = X509V3_EXT_get (extension );
1724
+ if (method == NULL ) {
1725
+ return -1 ;
1726
+ }
1727
+
1728
+ p = extension -> value -> data ;
1729
+ length = extension -> value -> length ;
1730
+ if (method -> it ) {
1731
+ names = (GENERAL_NAMES * )(ASN1_item_d2i (NULL , & p , length ,
1732
+ ASN1_ITEM_ptr (method -> it )));
1733
+ } else {
1734
+ names = (GENERAL_NAMES * )(method -> d2i (NULL , & p , length ));
1735
+ }
1736
+ if (names == NULL ) {
1737
+ return -1 ;
1738
+ }
1739
+
1740
+ num = sk_GENERAL_NAME_num (names );
1741
+ for (i = 0 ; i < num ; i ++ ) {
1742
+ GENERAL_NAME * name ;
1743
+ ASN1_STRING * as ;
1744
+ name = sk_GENERAL_NAME_value (names , i );
1745
+ switch (name -> type ) {
1746
+ case GEN_EMAIL :
1747
+ BIO_puts (bio , "email:" );
1748
+ as = name -> d .rfc822Name ;
1749
+ BIO_write (bio , ASN1_STRING_data (as ),
1750
+ ASN1_STRING_length (as ));
1751
+ break ;
1752
+ case GEN_DNS :
1753
+ BIO_puts (bio , "DNS:" );
1754
+ as = name -> d .dNSName ;
1755
+ BIO_write (bio , ASN1_STRING_data (as ),
1756
+ ASN1_STRING_length (as ));
1757
+ break ;
1758
+ case GEN_URI :
1759
+ BIO_puts (bio , "URI:" );
1760
+ as = name -> d .uniformResourceIdentifier ;
1761
+ BIO_write (bio , ASN1_STRING_data (as ),
1762
+ ASN1_STRING_length (as ));
1763
+ break ;
1764
+ default :
1765
+ /* use builtin print for GEN_OTHERNAME, GEN_X400,
1766
+ * GEN_EDIPARTY, GEN_DIRNAME, GEN_IPADD and GEN_RID
1767
+ */
1768
+ GENERAL_NAME_print (bio , name );
1769
+ }
1770
+ /* trailing ', ' except for last element */
1771
+ if (i < (num - 1 )) {
1772
+ BIO_puts (bio , ", " );
1773
+ }
1774
+ }
1775
+ sk_GENERAL_NAME_pop_free (names , GENERAL_NAME_free );
1776
+
1777
+ return 0 ;
1778
+ }
1779
+
1713
1780
/* {{{ proto array openssl_x509_parse(mixed x509 [, bool shortnames=true])
1714
1781
Returns an array of the fields/values of the CERT */
1715
1782
PHP_FUNCTION (openssl_x509_parse )
@@ -1806,15 +1873,29 @@ PHP_FUNCTION(openssl_x509_parse)
1806
1873
1807
1874
1808
1875
for (i = 0 ; i < X509_get_ext_count (cert ); i ++ ) {
1876
+ int nid ;
1809
1877
extension = X509_get_ext (cert , i );
1810
- if (OBJ_obj2nid (X509_EXTENSION_get_object (extension )) != NID_undef ) {
1878
+ nid = OBJ_obj2nid (X509_EXTENSION_get_object (extension ));
1879
+ if (nid != NID_undef ) {
1811
1880
extname = (char * )OBJ_nid2sn (OBJ_obj2nid (X509_EXTENSION_get_object (extension )));
1812
1881
} else {
1813
1882
OBJ_obj2txt (buf , sizeof (buf )- 1 , X509_EXTENSION_get_object (extension ), 1 );
1814
1883
extname = buf ;
1815
1884
}
1816
1885
bio_out = BIO_new (BIO_s_mem ());
1817
- if (X509V3_EXT_print (bio_out , extension , 0 , 0 )) {
1886
+ if (nid == NID_subject_alt_name ) {
1887
+ if (openssl_x509v3_subjectAltName (bio_out , extension ) == 0 ) {
1888
+ add_assoc_stringl (subitem , extname , bio_buf -> data , bio_buf -> length , 1 );
1889
+ } else {
1890
+ zval_dtor (return_value );
1891
+ if (certresource == -1 && cert ) {
1892
+ X509_free (cert );
1893
+ }
1894
+ BIO_free (bio_out );
1895
+ RETURN_FALSE ;
1896
+ }
1897
+ }
1898
+ else if (X509V3_EXT_print (bio_out , extension , 0 , 0 )) {
1818
1899
BIO_get_mem_ptr (bio_out , & bio_buf );
1819
1900
add_assoc_stringl (subitem , extname , bio_buf -> data , bio_buf -> length , 1 );
1820
1901
} else {
0 commit comments