[php-src] master: Fix use-after-free in OpenSSL empty cafile warning (GH-22880)

Author: Ilija Tovilo (iluuu1994)
Committer: GitHub (web-flow)
Pusher: iluuu1994
Date: 2026-08-05T16:28:48+02:00

Commit: https://github.com/php/php-src/commit/d2780bcbaea2c9e90dbff482eced68ad3a98b499
Raw diff: https://github.com/php/php-src/commit/d2780bcbaea2c9e90dbff482eced68ad3a98b499.diff

Fix use-after-free in OpenSSL empty cafile warning (GH-22880)

Changed paths:
  A  ext/openssl/tests/stream_cafile_no_valid_certs.phpt
  M  ext/openssl/xp_ssl.c


Diff:

diff --git a/ext/openssl/tests/stream_cafile_no_valid_certs.phpt b/ext/openssl/tests/stream_cafile_no_valid_certs.phpt
new file mode 100644
index 000000000000..4622dfbf5765
--- /dev/null
+++ b/ext/openssl/tests/stream_cafile_no_valid_certs.phpt
@@ -0,0 +1,42 @@
+--TEST--
+SSL cafile stream containing no valid certificates
+--EXTENSIONS--
+openssl
+--SKIPIF--
+<?php
+if (!function_exists('proc_open')) die('skip no proc_open');
+?>
+--FILE--
+<?php
+$serverCode = <<<'CODE'
+    $server = stream_socket_server('tcp://127.0.0.1:0', $errno, $errstr);
+    phpt_notify_server_start($server);
+
+    $client = stream_socket_accept($server, 2);
+    if ($client) {
+        fclose($client);
+    }
+CODE;
+
+$clientCode = <<<'CODE'
+    $context = stream_context_create(['ssl' => [
+        'cafile' => 'file://%s',
+    ]]);
+    var_dump(stream_socket_client(
+        'ssl://{{ ADDR }}',
+        timeout: 2,
+        context: $context,
+    ));
+CODE;
+$clientCode = sprintf($clientCode, __DIR__ . '/plain.txt');
+
+include 'ServerClientTestCase.inc';
+ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+?>
+--EXPECTF--
+Warning: stream_socket_client(): no valid certs found cafile stream: '%s' in %sServerClientTestCase.inc(%d) : eval()'d code on line 4
+
+Warning: stream_socket_client(): Failed to enable crypto in %sServerClientTestCase.inc(%d) : eval()'d code on line 4
+
+Warning: stream_socket_client(): Unable to connect to ssl://127.0.0.1:%d (Unknown error) in %sServerClientTestCase.inc(%d) : eval()'d code on line 4
+bool(false)
diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
index 130d3717ccc9..269de9545388 100644
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -947,15 +947,14 @@ static long php_openssl_load_stream_cafile(X509_STORE *cert_store, const char *c
 		goto cert_start;
 	}
 
-	stream_complete: {
-		php_stream_close(stream);
-		if (buffer_active == 1) {
-			BIO_free(buffer);
-		}
+stream_complete:
+	if (certs_added == 0) {
+		php_stream_warn(stream, DecodingFailed, "no valid certs found cafile stream: '%s'", cafile);
 	}
 
-	if (certs_added == 0) {
-		php_stream_warn(stream, DecodingFailed, "no valid certs found cafile stream: `%s'", cafile);
+	php_stream_close(stream);
+	if (buffer_active == 1) {
+		BIO_free(buffer);
 	}
 
 	return certs_added;