[php-src] Issue #22186: Memory corruption (zend_mm_heap corrupted) in `openssl_encrypt` with AES-WRAP-PAD

[email protected] (olegbaturin) Fri, 29 May 2026 19:03:20 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22186
Author: olegbaturin

### Description

The following code:

```php
<?php
$algo = "AES-128-WRAP-PAD";
$pass = random_bytes(16);
$iv = str_repeat("\0", 4);
for ($i = 1; $i < 258; $i++) {
    $data = random_bytes($i);
    echo "$i.";
    $enc = openssl_encrypt($data, $algo, $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
}
```

Commad line:
```
php -r '$algo = "AES-128-WRAP-PAD"; $pass = random_bytes(16); $iv = str_repeat("\0", 4); for ($i = 1; $i < 258; $i++) { $data = random_bytes($i); echo $i.".";  openssl_encrypt($data, $algo, $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv); }'
```

Resulted in this output:
```
1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.zend_mm_heap corrupted
```


### PHP Version

```plain
PHP 8.5.6 (cli) (built: May 19 2026 23:08:03) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.6, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies

OpenSSL 3.5.6 7 Apr 2026

---

PHP 8.5.6 (cli) (built: May  6 2026 09:31:05) (ZTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.6, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.6, Copyright (c), by Zend Technologies

OpenSSL 3.5.6 7 Apr 2026

---

PHP 8.4.21 (cli) (built: May 19 2026 23:08:19) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.21, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies

OpenSSL 3.5.6 7 Apr 2026

---

PHP 8.4.21 (cli) (built: May  6 2026 09:30:47) (ZTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.4.21, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies

OpenSSL 3.0.20 7 Apr 2026
```

### Operating System

_No response_