From aa550b9abadc109a2c89a7cd6dd047ac2a953027 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Sat, 6 Oct 2018 16:15:00 +0000 Subject: Bump a bit the coverage * `setcookie` doesn't always return `true` anymore * clang-format * Cookies with invalid decryption are dropped, but the request isn't anymore * faulty unserialize are now dumpable--- src/sp_crypt.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) (limited to 'src/sp_crypt.c') diff --git a/src/sp_crypt.c b/src/sp_crypt.c index 96a0cc0..b6eaa59 100644 --- a/src/sp_crypt.c +++ b/src/sp_crypt.c @@ -27,11 +27,10 @@ void generate_key(unsigned char *key) { if (env_var) { PHP_SHA256Update(&ctx, (unsigned char *)env_var, strlen(env_var)); } else { - sp_log_warn( - "cookie_encryption", - "The environment variable '%s' " - "is empty, cookies are weakly encrypted", - ZSTR_VAL(env_var_zend)); + sp_log_warn("cookie_encryption", + "The environment variable '%s' " + "is empty, cookies are weakly encrypted", + ZSTR_VAL(env_var_zend)); } if (encryption_key) { @@ -61,14 +60,16 @@ int decrypt_zval(zval *pDest, bool simulation, zend_hash_key *hash_key) { hash_key ? ZSTR_VAL(hash_key->key) : "the session"); return ZEND_HASH_APPLY_KEEP; } else { + // LCOV_EXCL_START sp_log_msg( "cookie_encryption", SP_LOG_DROP, "Buffer underflow tentative detected in cookie encryption handling"); return ZEND_HASH_APPLY_REMOVE; + // LCOV_EXCL_STOP } } - // LCOV_EXCL_START + // LCOV_EXCL_START if (ZSTR_LEN(debase64) + (size_t)crypto_secretbox_ZEROBYTES < ZSTR_LEN(debase64)) { if (true == simulation) { @@ -85,7 +86,7 @@ int decrypt_zval(zval *pDest, bool simulation, zend_hash_key *hash_key) { return ZEND_HASH_APPLY_REMOVE; } } - // LCOV_EXCL_END + // LCOV_EXCL_STOP generate_key(key); @@ -106,7 +107,7 @@ int decrypt_zval(zval *pDest, bool simulation, zend_hash_key *hash_key) { hash_key ? ZSTR_VAL(hash_key->key) : "the session"); return ZEND_HASH_APPLY_KEEP; } else { - sp_log_msg("cookie_encryption", SP_LOG_DROP, + sp_log_msg("cookie_encryption", SP_LOG_WARN, "Something went wrong with the decryption of %s", hash_key ? ZSTR_VAL(hash_key->key) : "the session"); return ZEND_HASH_APPLY_REMOVE; -- cgit v1.3