Repository navigation
openssl_pkey_new() memory leak #19910
Description
Description
The following code:
<?php
function foo($v_288787='\n',)
{
$v_288706 = $v_288706;
}
function openssl_pkey_test_cmp($v_288707,$v_288736='11',)
{
$v_288707 = $v_288707;
$v_288708 = $v_288708;
$v_288812 = 'q';
$v_288709 = '0';
$v_288710 = ltrim($v_288812,$v_288709,);
}
$v_288714 = 'BBF82F090682CE9C2338AC2B9DA871F7368D07EED41043A440D6B6F07454F51F';
$v_288715 = 'B8DFBAAF035C02AB61EA48CEEB6FCD4876ED520D60E1EC4619719D8A5B8B807F';
$v_288716 = $v_288714 . $v_288715;
$v_288717 = 'AFB8E0A3DFC737723EE6B4B7D93A2584EE6A649D060953748834B2454598394E';
$v_288718 = $v_288716 . $v_288717;
$v_288744 = hex2bin($v_288720,);
$v_288723 = '9410B3C7998D6BC465745E5C392669D6870DA2C082A939E37FDCB82EC93EDAC9';
$v_288729 = 'EECFAE81B1B9B3C908810B10A1B5600199EB9F44AEF4FDA493B81A9E3D84F632';
$v_288725 = '7FF3AD5950ACCFBC111C76F1A9529444E56AAF68C56C092CD38DC3BEF5D20A93';
$v_288726 = $v_288729 . $v_288725;
$v_288727 = '9926ED4F74A13EDDFBE1A1CECC4894AF9428C2B7B8883FE4463A4BC85B1CB3C1';
$v_288728 = $v_288726 . $v_288727;
$v_288748 = hex2bin($v_288728,);
$v_288778 = 'dmp1';
$v_288750 = hex2bin($v_288778,);
$v_288735 = '11';
$v_288754 = hex2bin($v_288735,);
$v_288736 = $v_288736;
$v_288756 = hex2bin($v_288736,);
$v_288737 = 'b06c4fdabb6301198d265bdbae9423b380f271f73453885093077fcd39e2119f';
$v_288738 = 'c98632154f5883b167a967bf402b4e9e2e0f9656e698ea3666edfb25798039f7';
$v_288739 = $v_288737 . $v_288738;
$v_288758 = hex2bin($v_288739,);
$v_288742 = array('n' => $v_288744,'e' => $v_288723,'d' => $v_288748,'p' => $v_288750,'q' => $v_288709,'dmp1' => $v_288754,'dmq1' => $v_288756,'iqmp' => $v_288758,);
$v_288740 = array('rsa' => $v_288742,);
$v_288759 = openssl_pkey_new($v_288740,);Resulted in this output:
Warning: Undefined variable $v_288720 in /home/w023dtc/treebugs/963e5353adfc6e438f99.php.er on line 19
Deprecated: hex2bin(): Passing null to parameter #1 ($string) of type string is deprecated in /home/w023dtc/treebugs/963e5353adfc6e438f99.php.er on line 19
Warning: hex2bin(): Input string must be hexadecimal string in /home/w023dtc/treebugs/963e5353adfc6e438f99.php.er on line 28
Warning: Undefined variable $v_288736 in /home/w023dtc/treebugs/963e5353adfc6e438f99.php.er on line 31
Deprecated: hex2bin(): Passing null to parameter #1 ($string) of type string is deprecated in /home/w023dtc/treebugs/963e5353adfc6e438f99.php.er on line 32
Warning: Undefined variable $v_288709 in /home/w023dtc/treebugs/963e5353adfc6e438f99.php.er on line 37
=================================================================
==2512238==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 72 byte(s) in 3 object(s) allocated from:
#0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
#1 0x1484e4d8f6dd in CRYPTO_zalloc (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1b76dd)
Indirect leak of 72 byte(s) in 2 object(s) allocated from:
#0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
#1 0x1484e4d8f6dd in CRYPTO_zalloc (/lib/x86_64-linux-gnu/libcrypto.so.3+0x1b76dd)
SUMMARY: AddressSanitizer: 144 byte(s) leaked in 5 allocation(s).
PHP Version
nightly
Operating System
ubuntu 22.04
Activity
devnexen commentedon Sep 22, 2025
hmm can t see even with valgrind, or tweaking USE_ZEND_ALLOC. What s your openssl version ?
devnexen commentedon Sep 22, 2025
By the way for next, would it be possible to set this ? that would display a more thorough report. Cheers.
ndossche commentedon Sep 22, 2025
No, they need to set the env var ASAN_OPTIONS="fast_unwind_on_malloc=0" for a more thorough report in this case
chongwick commentedon Sep 22, 2025
OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
devnexen commentedon Sep 22, 2025
Ok well, normally 3.0.2 contains this fix(nvm: was taken care of anyway apparently), no idea where this could be from. So I ll let the expert talk :)ndossche commentedon Sep 30, 2025
Repros in 3.0.2, 3.1.0, 3.2.0 but not in 3.3.0.
So I ran a bisect and ended up at openssl/openssl@f3be536
Also wow this took an hour to bisect because of how long it takes to build openssl.
So @chongwick this is an openssl bug not a PHP bug. Closing as such.
bukka commentedon Oct 13, 2025
@nielsdos is it already fixed in OpenSSL or should it be reported upstream?
ndossche commentedon Oct 13, 2025
@bukka This is already fixed upstream