Merge branch 'master' into reproducible-phar

asjur · Apr 13, 2019 · 1558d82 · 1558d82
2 parents 92dd73c + 147b536
commit 1558d82
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 14 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -21,11 +21,11 @@ matrix:
     - php: "hhvm"
       env: USE_PSALM=1
   allow_failures:
+    - php: "5.4"
+    - php: "5.5"
     - php: "nightly"
     - php: "hhvm"
-
 install:
-    - if [[ $USE_PSALM -eq 1 ]]; then composer require --dev "vimeo/psalm:dev-master"; fi
     - composer install
     - curl -LSs https://box-project.github.io/box2/installer.php | php
     - mkdir ~/box
@@ -35,6 +35,8 @@ script:
     - ./test.sh
     - PATH=$PATH:~/box/ make -C dist/ build-phar
     - ./test.sh dist/defuse-crypto.phar
+    - if [[ $USE_PSALM -eq 1 ]]; then composer require --dev "vimeo/psalm:dev-master"; fi
+    - if [[ $USE_PSALM -eq 1 ]]; then composer install; fi
     - if [[ $USE_PSALM -eq 1 ]]; then vendor/bin/psalm; fi
 
 after_success:

diff --git a/README.md b/README.md
@@ -9,9 +9,15 @@ php-encryption
 [![Downloads](https://img.shields.io/packagist/dt/defuse/php-encryption.svg)](https://packagist.org/packages/defuse/php-encryption)
 
 This is a library for encrypting data with a key or password in PHP. **It
-requires PHP 5.6 or newer and OpenSSL 1.0.1 or newer.** The current version is
-v2.2.1, which is expected to remain stable and supported by its authors with
-security and bugfixes until at least January 1st, 2020.
+requires PHP 5.6 or newer and OpenSSL 1.0.1 or newer.** We recommend using
+a version of PHP that [still has security
+support](https://www.php.net/supported-versions.php), which at the time of
+writing means PHP 7.1 or later. Using this library with an unsupported version
+of PHP could lead to security vulnerabilities.
+
+The current version of `php-encryption` is v2.2.1. This library is expected to
+remain stable and supported by its authors with security and bugfixes until at
+least January 1st, 2021.
 
 The library is a joint effort between [Taylor Hornby](https://defuse.ca/) and
 [Scott Arciszewski](https://paragonie.com/blog/author/scott-arcizewski) as well

diff --git a/src/File.php b/src/File.php
@@ -320,6 +320,9 @@ private static function decryptFileInternal($inputFilename, $outputFilename, Key
      *
      * @throws Ex\EnvironmentIsBrokenException
      * @throws Ex\IOException
+     * @psalm-suppress PossiblyInvalidArgument
+     *      Fixes erroneous errors caused by PHP 7.2 switching the return value
+     *      of hash_init from a resource to a HashContext.
      */
     private static function encryptResourceInternal($inputHandle, $outputHandle, KeyOrPassword $secret)
     {
@@ -346,7 +349,7 @@ private static function encryptResourceInternal($inputHandle, $outputHandle, Key
         $iv     = Core::secureRandom($ivsize);
 
         /* Initialize a streaming HMAC state. */
-        /** @var resource $hmac */
+        /** @var mixed $hmac */
         $hmac = \hash_init(Core::HASH_FUNCTION_NAME, HASH_HMAC, $akey);
         Core::ensureTrue(
             \is_resource($hmac) || \is_object($hmac),
@@ -436,6 +439,9 @@ private static function encryptResourceInternal($inputHandle, $outputHandle, Key
      * @throws Ex\EnvironmentIsBrokenException
      * @throws Ex\IOException
      * @throws Ex\WrongKeyOrModifiedCiphertextException
+     * @psalm-suppress PossiblyInvalidArgument
+     *      Fixes erroneous errors caused by PHP 7.2 switching the return value
+     *      of hash_init from a resource to a HashContext.
      */
     public static function decryptResourceInternal($inputHandle, $outputHandle, KeyOrPassword $secret)
     {
@@ -489,7 +495,7 @@ public static function decryptResourceInternal($inputHandle, $outputHandle, KeyO
         $inc = (int) (Core::BUFFER_BYTE_SIZE / Core::BLOCK_BYTE_SIZE);
 
         /* Get the HMAC. */
-        if (\fseek($inputHandle, (-1 * Core::MAC_BYTE_SIZE), SEEK_END) === false) {
+        if (\fseek($inputHandle, (-1 * Core::MAC_BYTE_SIZE), SEEK_END) === -1) {
             throw new Ex\IOException(
                 'Cannot seek to beginning of MAC within input file'
             );
@@ -511,19 +517,19 @@ public static function decryptResourceInternal($inputHandle, $outputHandle, KeyO
         $stored_mac = self::readBytes($inputHandle, Core::MAC_BYTE_SIZE);
 
         /* Initialize a streaming HMAC state. */
-        /** @var resource $hmac */
+        /** @var mixed $hmac */
         $hmac = \hash_init(Core::HASH_FUNCTION_NAME, HASH_HMAC, $akey);
         Core::ensureTrue(\is_resource($hmac) || \is_object($hmac), 'Cannot initialize a hash context');
 
         /* Reset file pointer to the beginning of the file after the header */
-        if (\fseek($inputHandle, Core::HEADER_VERSION_SIZE, SEEK_SET) === false) {
+        if (\fseek($inputHandle, Core::HEADER_VERSION_SIZE, SEEK_SET) === -1) {
             throw new Ex\IOException(
                 'Cannot read seek within input file'
             );
         }
 
         /* Seek to the start of the actual ciphertext. */
-        if (\fseek($inputHandle, Core::SALT_BYTE_SIZE + $ivsize, SEEK_CUR) === false) {
+        if (\fseek($inputHandle, Core::SALT_BYTE_SIZE + $ivsize, SEEK_CUR) === -1) {
             throw new Ex\IOException(
                 'Cannot seek input file to beginning of ciphertext'
             );
@@ -534,7 +540,7 @@ public static function decryptResourceInternal($inputHandle, $outputHandle, KeyO
         \hash_update($hmac, $header);
         \hash_update($hmac, $file_salt);
         \hash_update($hmac, $iv);
-        /** @var resource $hmac2 */
+        /** @var mixed $hmac2 */
         $hmac2 = \hash_copy($hmac);
 
         $break = false;
@@ -565,7 +571,7 @@ public static function decryptResourceInternal($inputHandle, $outputHandle, KeyO
             \hash_update($hmac, $read);
 
             /* Remember this buffer-sized chunk's HMAC. */
-            /** @var resource $chunk_mac */
+            /** @var mixed $chunk_mac */
             $chunk_mac = \hash_copy($hmac);
             Core::ensureTrue(\is_resource($chunk_mac) || \is_object($chunk_mac), 'Cannot duplicate a hash context');
             $macs []= \hash_final($chunk_mac);
@@ -585,7 +591,7 @@ public static function decryptResourceInternal($inputHandle, $outputHandle, KeyO
         /* PASS #2: Decrypt and write output. */
 
         /* Rewind to the start of the actual ciphertext. */
-        if (\fseek($inputHandle, Core::SALT_BYTE_SIZE + $ivsize + Core::HEADER_VERSION_SIZE, SEEK_SET) === false) {
+        if (\fseek($inputHandle, Core::SALT_BYTE_SIZE + $ivsize + Core::HEADER_VERSION_SIZE, SEEK_SET) === -1) {
             throw new Ex\IOException(
                 'Could not move the input file pointer during decryption'
             );
@@ -619,7 +625,7 @@ public static function decryptResourceInternal($inputHandle, $outputHandle, KeyO
              * remembered from pass #1 to ensure attackers didn't change the
              * ciphertext after MAC verification. */
             \hash_update($hmac2, $read);
-            /** @var resource $calc_mac */
+            /** @var mixed $calc_mac */
             $calc_mac = \hash_copy($hmac2);
             Core::ensureTrue(\is_resource($calc_mac) || \is_object($calc_mac), 'Cannot duplicate a hash context');
             $calc = \hash_final($calc_mac);