File php7-CVE-2026-14355.patch of Package php7

From 169226847426368c62992af43c2c39b0fdbff4d5 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Fri, 29 May 2026 21:44:14 +0100
Subject: [PATCH] ext/openssl: openssl_encrypt() zend mm heap overflow on
 AES-WRAP-PAD mode.

Fix #22186

close GH-22187
---
 NEWS                           |  4 ++++
 ext/openssl/openssl.c          | 17 +++++++++++++++--
 ext/openssl/tests/gh22186.phpt | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 2 deletions(-)
 create mode 100644 ext/openssl/tests/gh22186.phpt

Index: php-7.4.33/ext/openssl/openssl.c
===================================================================
--- php-7.4.33.orig/ext/openssl/openssl.c
+++ php-7.4.33/ext/openssl/openssl.c
@@ -6670,6 +6670,7 @@ static int php_openssl_cipher_update(con
 		char *aad, size_t aad_len, int enc)  /* {{{ */
 {
 	int i = 0;
+	size_t outlen = data_len + EVP_CIPHER_block_size(cipher_type);
 
 	if (mode->is_single_run_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) {
 		php_openssl_store_errors();
@@ -6683,7 +6684,19 @@ static int php_openssl_cipher_update(con
 		return FAILURE;
 	}
 
-	*poutbuf = zend_string_alloc((int)data_len + EVP_CIPHER_block_size(cipher_type), 0);
+#ifdef EVP_CIPH_WRAP_MODE
+	if ((EVP_CIPHER_mode(cipher_type)) == EVP_CIPH_WRAP_MODE) {
+		/*
+		 * RFC 5649 wrap-with-padding rounds the input up to the block size
+		 * and prepends an integrity block, we reserve one extra block.
+		 * See EVP_EncryptUpdate(3): wrap mode may write up to
+		 * inl + cipher_block_size bytes.
+		 */
+		outlen += EVP_CIPHER_block_size(cipher_type);
+	}
+#endif
+
+	*poutbuf = zend_string_alloc(outlen, 0);
 
 	if (!EVP_CipherUpdate(cipher_ctx, (unsigned char*)ZSTR_VAL(*poutbuf),
 					&i, (unsigned char *)data, (int)data_len)) {