Avoid PHP warnings about undefined array keys when sanitizing malformed PEMs (#556)

* Avoid PHP warnings about undefined indexes when sanitizing malformed PEMs
* Add test for loading invalid PEM key

A new test function was added in ECKeysTest.php to handle cases of loading invalid PEM keys. An InvalidArgumentException is expected to be thrown with a specific error message when an invalid private PEM key is loaded.

---------

Co-authored-by: Florent Morselli <florent.morselli@spomky-labs.com>

Author: crocodele

src/Library/KeyManagement/KeyConverter/KeyConverter.php

@@ -365,7 +365,11 @@ private static function getCurve(string $oid): string
      */
     private static function sanitizePEM(string &$pem): void
     {
-        preg_match_all('#(-.*-)#', $pem, $matches, PREG_PATTERN_ORDER);
+        $number = preg_match_all('#(-.*-)#', $pem, $matches, PREG_PATTERN_ORDER);
+        if ($number !== 2) {
+            throw new InvalidArgumentException('Unable to load the key');
+        }
+
         $ciphertext = preg_replace('#-.*-|\r|\n| #', '', $pem);
 
         $pem = $matches[0][0] . PHP_EOL;

tests/Component/KeyManagement/Keys/ECKeysTest.php

@@ -208,6 +208,31 @@ public function loadEncryptedPrivateEC512Key(): void
         ]);
     }
 
+    #[Test]
+    public function loadInvalidPEMKey(): void
+    {
+        // Then
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Unable to load the key');
+
+        // Given
+        $private_pem = trim(<<<PEM
+MIIB0jCCAXegAwIBAgIJAK2o1kQ5JwpUMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn
+aXRzIFB0eSBMdGQwHhcNMTUxMTA4MTUxMTU2WhcNMTYxMTA3MTUxMTU2WjBFMQsw
+CQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJu
+ZXQgV2lkZ2l0cyBQdHkgTHRkMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExEsr
+/55aqgFXdrbRNz1/WSNI8UaSUxCka2kGEN1bXsJIzjkeyv12dRHo7H5OmY2/Z9sN
+fgKhWj7elq0xSlcA0KNQME4wHQYDVR0OBBYEFKIGgCZoS388STT0qjoX/swKYBXh
+MB8GA1UdIwQYMBaAFKIGgCZoS388STT0qjoX/swKYBXhMAwGA1UdEwQFMAMBAf8w
+CgYIKoZIzj0EAwIDSQAwRgIhAK5OqQoBGR/pj2NOb+PyRKK4k4d3Muj9z/6LsJK+
+kkgUAiEA+FY4SWKv4mfe0gsOBId0Aah/HtVZxDBe3bCXOQM8MMM=
+PEM);
+
+        // When
+        KeyConverter::loadFromKey($private_pem, 'test');
+    }
+
     #[Test]
     public function convertPrivateKeyToPublic(): void
     {