Require librnp 0.18.1 (CVE-2025-13470), fix use-after-free, PHP 8.2-8.5 CI#14
Merged
Conversation
ZVAL_NEW_REF moves the zval into the new reference (ZVAL_COPY_VALUE semantics) without increasing the refcount, so destroying passwordval after the call operated on a dangling pointer as soon as the PHP callback reassigned the by-ref $password argument. librnp 0.18 requests passwords during key generation/protection, which made this reliably crash with "zend_mm_heap corrupted". Also make sure the callback left a string in the by-ref argument before reading it back.
SIZEOF_ZEND_LONG is the documented constant that is always defined by Zend, making the 64-bit branch selection explicit and portable.
0.18.1 is the security baseline: it fixes CVE-2025-13470 (PKESK session keys generated without cryptographically random values).
Since rnpgp/rnp#2246 (v0.18.0) rnp_input_from_memory() accepts zero-length input, so rnp_dump_packets('') now returns the ":empty input" dump and rnp_import_keys('') returns an empty key list instead of failing.
- rnp matrix: v0.16.2 -> v0.18.1 (the new minimum), keep main - PHP matrix: 8.0/8.1/8.2 -> 8.2/8.3/8.4/8.5 - actions/checkout v3 -> v4 - shivammathur/setup-php 2.22.0 -> v2
Mention CVE-2025-13470 as the reason for the 0.18.1 baseline.
ubuntu-latest (24.04) no longer ships bzip2/zlib development files, which made the rnp cmake configure step fail (Could NOT find BZip2).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings php-rnp up to date with the latest librnp release 0.18.1 (security release fixing CVE-2025-13470) and rnp's
main, makes 0.18.1 the enforced minimum, and fixes a real memory-corruption bug exposed by testing against 0.18.x.Bug fixes
rnp.c):ZVAL_NEW_REF(&args[2], &passwordval)moves the zval (PHP 8.x usesZVAL_COPY_VALUE, no addref), so the laterzval_ptr_dtor(&passwordval)double-freed the string once the PHP callback reassigned$password. librnp 0.18's keygen/protect path invokes the password provider in more contexts ("protect"/"add subkey"), turning this latent heap corruption into a reliablezend_mm_heap corruptedcrash (test 007). Fixed by dropping the extra dtor + anIS_STRINGguard on read-back; verified crash-free under GuardMalloc. A plain-C reproducer confirmed librnp itself is not at fault.rnp_key_valid_tillselection: switched the preprocessor selection to the documented, always-definedSIZEOF_ZEND_LONG >= 8form (strictly more portable; no behavior change on 64-bit PHP >= 8.0).rnp_input_from_memory()accepts zero-length input —rnp_dump_packets('')andrnp_import_keys('')now return empty results instead offalse. Expectations updated with comments pointing at the upstream change.Requirements & CI
PKG_CHECK_MODULES([LIBRNP], [librnp >= 0.18.1])— builds against CVE-affected librnp are now rejected at configure time.test.yml): librnp matrix →v0.18.1+main(matching the new minimum); PHP matrix 8.0–8.2 → 8.2/8.3/8.4/8.5;actions/checkout@v4;shivammathur/setup-php@v2.Verification (local, PHP 8.5.8 NTS, macOS arm64)
phpize && ./configure && make: clean, zero compiler warnings fromrnp.c;rnp_arginfo.hneeded no regeneration for 8.5DYLD_PRINT_LIBRARIES)Notes for maintainers
package.xmlleft at 0.2.0 (release action) — consider a version bump and PHP min 8.2 there at release time.config.w32(Windows) has no version constraint; pkg-config isn't used there.rnp_signature_error_count/at, key certification API) not yet wrapped — potential follow-up.Related PRs
The fixes here overlap with older open PRs: #13 (segfault in
php_rnp_password_callback— same use-after-free fixed here with a GuardMalloc-verified, slightly different fix) and #11 (zero-length input handling for librnp 0.18 — also covered here). This PR likely supersedes both.