[php-src] Issue #22186: Memory corruption (zend_mm_heap corrupted) in `openssl_encrypt` with AES-WRAP-PAD
[email protected] (olegbaturin) Fri, 29 May 2026 19:03:20 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22186
Author: olegbaturin
### Description
The following code:
```php
<?php
$algo = "AES-128-WRAP-PAD";
$pass = random_bytes(16);
$iv = str_repeat("\0", 4);
for ($i = 1; $i < 258; $i++) {
$data = random_bytes($i);
echo "$i.";
$enc = openssl_encrypt($data, $algo, $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
}
```
Commad line:
```
php -r '$algo = "AES-128-WRAP-PAD"; $pass = random_bytes(16); $iv = str_repeat("\0", 4); for ($i = 1; $i < 258; $i++) { $data = random_bytes($i); echo $i."."; openssl_encrypt($data, $algo, $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv); }'
```
Resulted in this output:
```
1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.zend_mm_heap corrupted
```
### PHP Version
```plain
PHP 8.5.6 (cli) (built: May 19 2026 23:08:03) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.6, Copyright (c) Zend Technologies
with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies
OpenSSL 3.5.6 7 Apr 2026
---
PHP 8.5.6 (cli) (built: May 6 2026 09:31:05) (ZTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.6, Copyright (c) Zend Technologies
with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies
OpenSSL 3.5.6 7 Apr 2026
---
PHP 8.4.21 (cli) (built: May 19 2026 23:08:19) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.21, Copyright (c) Zend Technologies
with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies
OpenSSL 3.5.6 7 Apr 2026
---
PHP 8.4.21 (cli) (built: May 6 2026 09:30:47) (ZTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.4.21, Copyright (c) Zend Technologies
with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies
OpenSSL 3.0.20 7 Apr 2026
```
### Operating System
_No response_