Skip to content

Commit 239eace

Browse files
committed
Fix bug #79589: ssl3_read_n:unexpected eof while reading
The unexpected EOF failure was introduced in OpenSSL 3.0 to prevent truncation attack. However there are many non complaint servers and it is causing break for many users including those where truncation attack is not an issue becuase it would break format parsing (e.g. JSON). we try to keep behavior consitent with older version which is also the path chosen by some other languages and web servers. Closes GH-8369
1 parent 49549ea commit 239eace

File tree

2 files changed

+26
-0
lines changed

2 files changed

+26
-0
lines changed

ext/openssl/tests/bug79589.phpt

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #65538: TLS unexpected EOF failure
3+
--EXTENSIONS--
4+
openssl
5+
--SKIPIF--
6+
<?php
7+
if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$release = file_get_contents(
13+
'https://chromedriver.storage.googleapis.com/LATEST_RELEASE',
14+
false,
15+
stream_context_create(['ssl' => ['verify_peer'=> false]])
16+
);
17+
echo gettype($release);
18+
19+
?>
20+
--EXPECT--
21+
string

ext/openssl/xp_ssl.c

+5
Original file line numberDiff line numberDiff line change
@@ -1639,6 +1639,11 @@ int php_openssl_setup_crypto(php_stream *stream,
16391639

16401640
ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
16411641

1642+
#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
1643+
/* Only for OpenSSL 3+ to keep OpenSSL 1.1.1 behavior */
1644+
ssl_ctx_options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
1645+
#endif
1646+
16421647
if (!GET_VER_OPT("disable_compression") || zend_is_true(val)) {
16431648
ssl_ctx_options |= SSL_OP_NO_COMPRESSION;
16441649
}

0 commit comments

Comments
 (0)