Stricter content length in ASNObject #2
Conversation
Also fixes a PHP 8 deprecation
| $result = ''; | ||
|
|
||
| //Actual content | ||
| while (strlen($value) >= 2) { | ||
| // get the hex value byte by byte from the string and and add it to binary result | ||
| $result .= chr(hexdec(substr($value, 0, 2))); | ||
| $result .= @chr(hexdec(substr($value, 0, 2))); |
There was a problem hiding this comment.
We may want to replace chr($val) with pack('C', $val).
https://paragonie.com/blog/2017/02/cryptographically-secure-php-development#chr
paragonie-security
changed the title
This is an invalid state
paragonie-security
force-pushed
the
master
branch
from
e77e8b9
to
346ac23
Compare
Depends on genkgo/php-asn1#2
|
For now I did not replace |
|
There's some weird behavior that this library seems to be relying on. That code in question seems to expect hex data, but sometimes operates over raw bytes. If you "fix" this bug, you get a bunch of test failures. I suspect there be dragons here. |
|
That's exactly why I also chose to leave this for now. First, I am going to make this library use strict types and add phpstan. Then let's see which other optimizations and fixes we can introduce. |
Also fixes a PHP 8 deprecation