CRL signing fails with PHP 7.2

[JohnKiller]

Hi,
We have tried to sign a CRL with PHP 7.2 and it gives this error:

[reason] => Undefined offset: 0
[file] => phpseclib/phpseclib/phpseclib/File/X509.php:1651
[trace] => #0 phpseclib/phpseclib/phpseclib/File/X509.php(1651): exceptions_error_handler(8, 'Undefined offse...', '...', 1651, Array)
phpseclib/phpseclib/phpseclib/File/X509.php(3313): phpseclib\File\X509->_mapOutExtensions(Array, 'tbsCertList/crl...', Object(phpseclib\File\ASN1))
phpseclib/phpseclib/phpseclib/File/X509.php(3791): phpseclib\File\X509->saveCRL(Array)
test.php(99): phpseclib\File\X509->signCRL(Object(phpseclib\File\X509), Object(phpseclib\File\X509))

With PHP 7.1 this works fine. I've checked the line with the error:

        if (is_array($extensions)) {
            $size = count($extensions);
            for ($i = 0; $i < $size; $i++) {
                if ($extensions[$i] instanceof Element) {

By printing $extensions I've noticed that the array starts at 1 instead of 0, causing the error.

Library version is latest from composer. What can I do to help resolve the issue?
Thanks

[terrafrost]

Can you post your code? I tried to sign a CRL and encountered no issues:

<?php
require_once __DIR__ . '/vendor/autoload.php';

error_reporting(E_ALL);

use phpseclib\Crypt\RSA;
use phpseclib\File\X509;

// Load the CA and its private key.
$pemcakey = '-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQC0N7wYdy8DdSa4DCk6gyVIndq7N896/OFFOMJ6GCacXmSIUH5+
JptX8mOsq0czAklA6InRqe8c+PCI4BP3hmvZJpANxhu/UrZOxwHxCq3twPERXoyV
hMd9+fsfKtNJWCmv5R25MrvUAisvOZvBPn1Jf7efX6vusm3WAEdDyK8hmwIDAQAB
AoGAKZVar4KAtJmJj5ouwTOVnMXfvKdKFqTXDfPk2+tKrXYSWGnKZi1eVtK1MRhs
W1bBtFpzwo8lf1fpmIurz8eShqsK5cZqY1bV/0g2nyKVFkUJJsULGkOLkOGo1Ac1
lh1bBPtQVYw5iy6WydxVNWps5/cYm60q7e2MgB7rbFxYrSECQQDsl38TAyDu5/PK
44DdY4Je/y26fXwuzkw7V/Tk2VfCv1pYqx+65Z7JG75la22Q7hlWipsRvt2M2VyX
X/pV3+0JAkEAwwBdYVORzs72fak7pJGKZPfRUgX4E4wHb3LSPfViYeXxoM7QYFIj
V/ke6FDvs51M31JqsdSjCFpygzgENn2mgwJBAMGs7uCQchhAlykife49tI6xlCyS
5uKmDG+T/CyO4zHQVVQ6mZn0uLxm0sDRZXr7/pACnRi0x0ay9QISFqrPyYkCQHoC
ymrRTVQnLxelQgpQflV6seAul/AzF5vmLiJSXUKAC9XgUYVTH4Y1+97EdZbe/3Bk
Mxodv/zECw6LiCdIK10CQQC2b11DZvuvb5CL7fWf/1Kc1bYD1Je/K+g3WWyRe3cs
I59zJcLzCoX0W6JWI6WLX3TycOWpU+Y/5k3urpNf+l4s
-----END RSA PRIVATE KEY-----';
$cakey = new RSA();
$cakey->loadKey($pemcakey);
$pemca = '-----BEGIN CERTIFICATE-----
MIIBwzCCASygAwIBAgIUUFQqs3DNCuPEHmCO7tF4btMiKD8wDQYJKoZIhvcNAQEF
BQAwHjEcMBoGA1UECgwTcGhwc2VjbGliIGRlbW8gY2VydDAeFw0xODAxMjAxNDEy
MTVaFw0xOTAxMjAxNDEyMTVaMB4xHDAaBgNVBAoME3BocHNlY2xpYiBkZW1vIGNl
cnQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALQ3vBh3LwN1JrgMKTqDJUid
2rs3z3r84UU4wnoYJpxeZIhQfn4mm1fyY6yrRzMCSUDoidGp7xz48IjgE/eGa9km
kA3GG79Stk7HAfEKre3A8RFejJWEx335+x8q00lYKa/lHbkyu9QCKy85m8E+fUl/
t59fq+6ybdYAR0PIryGbAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAES2cxZ2WopL2
35LgFDo5bfmmMgPeRutRz5+uajPen3dCX/NKLgNdynhvEtfE51xdyLkX2dOzd+FB
E2kIP8bOCn2CoW7vLB/9PSyZLlfCkZ3b0gKanU44tH5DC35IrCGke7OC8AaSKl3/
17fMuQ+Q2q0WXr1hdAmydRJwaIj00jo=
-----END CERTIFICATE-----';
$ca = new X509();
$ca->loadX509($pemca);
$ca->setPrivateKey($cakey);

// Build the (empty) certificate revocation list.
$crl = new X509();
$crl->loadCRL($crl->saveCRL($crl->signCRL($ca, $crl)));

// Revoke a certificate.
$crl->setRevokedCertificateExtension('1234', 'id-ce-cRLReasons', 'privilegeWithdrawn');

// Sign the CRL.
$crl->setSerialNumber(1, 10);
$crl->setEndDate('+3 months');
//$crl->setExtension('id-ce-keyUsage', array('encipherOnly'));
$newcrl = $crl->signCRL($ca, $crl);

// Output it.
echo $crl->saveCRL($newcrl) . "\n";

By default at least one extension is added to CRL's with phpseclib: cRLNumber:

https://github.com/phpseclib/phpseclib/blob/2.0.9/phpseclib/File/X509.php#L3755

Here's what setExtension does:

https://github.com/phpseclib/phpseclib/blob/2.0.9/phpseclib/File/X509.php#L4146

ie. if the extension is already present it'll try to replace it. Otherwise it'll append it to the end of the extensions array using $extensions[] = $newext, which starts with zero.

Even if you tried to remove an extension it should reindex everything after the fact:

https://github.com/phpseclib/phpseclib/blob/2.0.9/phpseclib/File/X509.php#L4065

(in particular, see the array_values). So I have no idea how you're getting this error message...

[JohnKiller]

Hi,
Thanks for your response. Your code works correctly on my machine (it's very similar to what I have).
I've changed the key and the certificate in your script with my real data, and it failed again. I can't post the private key, but this is the public:

-----BEGIN CERTIFICATE-----
MIIF8TCCA9mgAwIBAgIJALT5mhqGYleqMA0GCSqGSIb3DQEBBQUAMIGOMQswCQYD
VQQGEwJJVDEOMAwGA1UECAwFSXRhbHkxFjAUBgNVBAcMDU1vbnRlY2Fzc2lhbm8x
HjAcBgNVBAoMFVNpc3RlbWEgMyBJbmZvcm1hdGljYTEbMBkGA1UECwwSUmljZXJj
YSBlIFN2aWx1cHBvMRowGAYDVQQDDBFTaXN0ZW1hIDMgUm9vdCBDQTAeFw0xNDEx
MjMxMzQyMzNaFw0zOTExMjMxMzQyMzNaMIGOMQswCQYDVQQGEwJJVDEOMAwGA1UE
CAwFSXRhbHkxFjAUBgNVBAcMDU1vbnRlY2Fzc2lhbm8xHjAcBgNVBAoMFVNpc3Rl
bWEgMyBJbmZvcm1hdGljYTEbMBkGA1UECwwSUmljZXJjYSBlIFN2aWx1cHBvMRow
GAYDVQQDDBFTaXN0ZW1hIDMgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIP
ADCCAgoCggIBAL/wPkjiXs5V52idGWIBCWcNq0AQMAP5blbREns31OEG5Llbn6/V
VgN70UAqfvogGNG9/AFopcHfQbR/oyFr4jFCkdbqxcUVzTZTaR8EtAXyTDorAfLh
gLqPgsk/gifO9Y5i786SdwHYMMdSFv+4S9FUlbnDuiMvsAkrKJ3AFf+/v8S0XCBc
eo4PbJ+/wZf7Mv8/O5CMkrQNivT8KqoXvQPo22DkV+L5bh5HmEQimGJ4JGLE6r7P
QeJCulg4GoaM/bESd7itUdEc/61Wn9CgR39kyo33IboQy6DjOnefMIkzD69yWzAv
PlSXAU7P44ZfkEFS7XWAhsXuLrffQ7VDw+PFNRoYwlAKVP9Xeda1FHnDlfqFUpsI
lnOaJOSXQRG9UqXCvQDw86L/PR9By9djLTq28Cx9VL0G4yZONOyH0DPsJa6OXMFf
I1sHPXNfSfbbmJ+tTza4Wges95/DD3OCo/EdyGnf37UKIoOcccHZ8ztkNyC+MS3s
5CSn5mYCnktMaQsQQGm37C4Xwyyn3XpqHCPvQgCKlTjsEbWfik+ywPrBu1QyogE5
Vvko/rvae0PtaxCjmssN5ZwFPFwOsXbva0ri55EoZDattgp6PQRR5JwxUwE1tdoO
NzYFxfkZqM8oKzwR+9gYFS7vRaqJPdbLC9kDrl5qW3BAVmY5HjsaHfCjAgMBAAGj
UDBOMB0GA1UdDgQWBBT/NdCDiImneP1eecoirO4OqFMGITAfBgNVHSMEGDAWgBT/
NdCDiImneP1eecoirO4OqFMGITAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
A4ICAQCsEoOpBlZ5MZkgDd6w1j45D1yINZzlKgvvLT6l4yIVfExbXeyPMB3UQsbQ
uinV8kTirV2kTDBm0EzjDZKfDMpTO14EPeCkB0rfubGUyikjhLp11dNXWeb5gCyQ
WxIiRlXeYTKO/TELUW652AwtELaGBIX6znSUpTlmlSzhD1+kfhmwwDoSoQqQ4GL9
55CxDh5arZsRisRvu+r2w4QhGHU5SHPq2lwXIjnqGR4jpQMmdz+eiwn/By1Lah7i
MzIFZGF2OaaUKKDBT9vEa+anYRqwVoYbs37EIS6Gc9ScraduOKmXS3UyPXkrqxjI
1PLBPhz8TWP+kiV8YBrvvtZJbeAM7KLBVBg6+/zlTL6ITznxQS7k/pAdv19SHLJz
6GBofJHNxrzjpojUP8ZW+LC26Z33MUenJxZKNQdKvVS+WY4hEMngGXE8BHzlBIBz
thiCZ5DQzqaxi2hFhFm6hO3PBTPtf+yAA10xFu7vCf1KJ7FvH10omAQ3od+7vakn
rbx53o66jGE92mMzZu9c13cYmbyRdRgFC5QneFyiY56FnvXGuJui135QL8OdDGKU
6YMQ4jgX7Vf4P082Mese4LGOyO5mLNsclgoak5v+R4KydBYGfEmlUq0fKt/BrCQW
RizfF10c66kOPL4FbRptl+HpM9+ZIZxJIjGOgwDwUuFQrZOZjw==
-----END CERTIFICATE-----

What can I do to help identify the issue?
Thanks

[terrafrost]

I was able to duplicate the problem.

This appears to be a PHP bug. phpseclib calls array_values and expects it to re-index at 0 except it's not - it's sometimes reindexing at 1.

It looks like there's already a bug report about it:

https://bugs.php.net/bug.php?id=75433
https://bugs.php.net/bug.php?id=75653

I'll contemplate possible workarounds.

Thanks for reporting!

[terrafrost]

8aecafc should fix this if you want to confirm.

[JohnKiller]

Thanks, this fixes the issue.

[JohnKiller]

PHP 7.2.2 released, issue fixed: https://3v4l.org/PqtOI

[terrafrost]

Good to know - thanks!