Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit()

The first one returns NULL on error, and the second one returns 0 on
error. These weren't checked.

Closes GH-10762.

NEWS

@@ -15,6 +15,8 @@ PHP                                                                        NEWS
 - Phar:
   . Fixed bug GH-10766 (PharData archive created with Phar::Zip format does
     not keep files metadata (datetime)). (nielsdos)
+  . Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit().
+    (nielsdos)
 
 16 Mar 2023, PHP 8.1.17
 

ext/phar/util.c

@@ -1579,7 +1579,15 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type,
 			}
 
 			md_ctx = EVP_MD_CTX_create();
-			EVP_VerifyInit(md_ctx, mdtype);
+			if (!md_ctx || !EVP_VerifyInit(md_ctx, mdtype)) {
+				if (md_ctx) {
+					EVP_MD_CTX_destroy(md_ctx);
+				}
+				if (error) {
+					spprintf(error, 0, "openssl signature could not be verified");
+				}
+				return FAILURE;
+			}
 			read_len = end_of_phar;
 
 			if ((size_t)read_len > sizeof(buf)) {