Skip to content

Commit 5fa335c

Browse files
LamentXU123thesamesam
LamentXU123
authored and
thesamesam
committed
ext/openssl: Fix build with OpenSSL 4.1 (#24686)
OpenSSL 4.1 deprecates ASN1_STRING_set() and ASN1_STRING_length(). use ASN1_STRING_set1_data() and ASN1_STRING_get_length() instead as recommended in official doc https://docs.openssl.org/4.1/man7/ossl-guide-migration/#asn1_string-values-have-never-been-nul-byte-terminated (cherry picked from commit 3678f39)
1 parent dfeef07 commit 5fa335c

4 files changed

Lines changed: 25 additions & 17 deletions

File tree

‎ext/openssl/openssl.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -629,7 +629,7 @@ PHP_FUNCTION(openssl_spki_new)
629629
}
630630

631631
if (challenge) {
632-
if (!ASN1_STRING_set(spki->spkac->challenge, challenge, (int)challenge_len)) {
632+
if (!ASN1_STRING_set1_data(spki->spkac->challenge, (const unsigned char *) challenge, challenge_len)) {
633633
php_openssl_store_errors();
634634
php_error_docref(NULL, E_WARNING, "Unable to set challenge data");
635635
goto cleanup;
@@ -818,7 +818,8 @@ PHP_FUNCTION(openssl_spki_export_challenge)
818818
goto cleanup;
819819
}
820820

821-
RETVAL_STRING((const char *)ASN1_STRING_get0_data(spki->spkac->challenge));
821+
RETVAL_STRINGL_FAST((const char *)ASN1_STRING_get0_data(spki->spkac->challenge),
822+
ASN1_STRING_get_length(spki->spkac->challenge));
822823
goto cleanup;
823824

824825
cleanup:

‎ext/openssl/openssl_backend_common.c‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ void php_openssl_add_assoc_name_entry(zval * val, char * key, const X509_NAME *
7575
} else {
7676
/* ASN1_STRING_get0_data(3): Since this is an internal pointer it should not be freed or modified in any way */
7777
to_add = ASN1_STRING_get0_data(str);
78-
to_add_len = ASN1_STRING_length(str);
78+
to_add_len = ASN1_STRING_get_length(str);
7979
}
8080

8181
if (to_add_len != -1) {
@@ -110,7 +110,7 @@ void php_openssl_add_assoc_name_entry(zval * val, char * key, const X509_NAME *
110110

111111
void php_openssl_add_assoc_asn1_string(zval * val, char * key, const ASN1_STRING * str)
112112
{
113-
add_assoc_stringl(val, key, (const char *)ASN1_STRING_get0_data(str), ASN1_STRING_length(str));
113+
add_assoc_stringl(val, key, (const char *)ASN1_STRING_get0_data(str), ASN1_STRING_get_length(str));
114114
}
115115

116116
time_t php_openssl_asn1_time_to_time_t(ASN1_UTCTIME * timestr)
@@ -126,6 +126,7 @@ time_t php_openssl_asn1_time_to_time_t(ASN1_UTCTIME * timestr)
126126
struct tm thetime;
127127
char * strbuf;
128128
char * thestr;
129+
const char *timestr_data;
129130
long gmadjust = 0;
130131
size_t timestr_len;
131132

@@ -134,24 +135,25 @@ time_t php_openssl_asn1_time_to_time_t(ASN1_UTCTIME * timestr)
134135
return (time_t)-1;
135136
}
136137

137-
timestr_len = (size_t)ASN1_STRING_length(timestr);
138+
timestr_len = ASN1_STRING_get_length(timestr);
139+
timestr_data = timestr_len ? (const char *)ASN1_STRING_get0_data(timestr) : "";
138140

139-
if (timestr_len != strlen((const char *)ASN1_STRING_get0_data(timestr))) {
141+
if (memchr(timestr_data, '\0', timestr_len) != NULL) {
140142
php_error_docref(NULL, E_WARNING, "Illegal length in timestamp");
141143
return (time_t)-1;
142144
}
143145

144146
if (timestr_len < 13) {
145-
php_error_docref(NULL, E_WARNING, "Unable to parse time string %s correctly", ASN1_STRING_get0_data(timestr));
147+
php_error_docref(NULL, E_WARNING, "Unable to parse time string %.*s correctly", (int)timestr_len, timestr_data);
146148
return (time_t)-1;
147149
}
148150

149151
if (ASN1_STRING_type(timestr) == V_ASN1_GENERALIZEDTIME && timestr_len < 15) {
150-
php_error_docref(NULL, E_WARNING, "Unable to parse time string %s correctly", ASN1_STRING_get0_data(timestr));
152+
php_error_docref(NULL, E_WARNING, "Unable to parse time string %.*s correctly", (int)timestr_len, timestr_data);
151153
return (time_t)-1;
152154
}
153155

154-
strbuf = estrdup((const char *)ASN1_STRING_get0_data(timestr));
156+
strbuf = estrndup(timestr_data, timestr_len);
155157

156158
memset(&thetime, 0, sizeof(thetime));
157159

@@ -633,7 +635,7 @@ int openssl_x509v3_subjectAltName(BIO *bio, PHP_OPENSSL_X509_EXTENSION *extensio
633635

634636
extension_data = X509_EXTENSION_get_data(extension);
635637
p = ASN1_STRING_get0_data(extension_data);
636-
length = ASN1_STRING_length(extension_data);
638+
length = ASN1_STRING_get_length(extension_data);
637639
if (method->it) {
638640
names = (GENERAL_NAMES*) (ASN1_item_d2i(NULL, &p, length,
639641
ASN1_ITEM_ptr(method->it)));
@@ -655,19 +657,19 @@ int openssl_x509v3_subjectAltName(BIO *bio, PHP_OPENSSL_X509_EXTENSION *extensio
655657
BIO_puts(bio, "email:");
656658
as = name->d.rfc822Name;
657659
BIO_write(bio, ASN1_STRING_get0_data(as),
658-
ASN1_STRING_length(as));
660+
ASN1_STRING_get_length(as));
659661
break;
660662
case GEN_DNS:
661663
BIO_puts(bio, "DNS:");
662664
as = name->d.dNSName;
663665
BIO_write(bio, ASN1_STRING_get0_data(as),
664-
ASN1_STRING_length(as));
666+
ASN1_STRING_get_length(as));
665667
break;
666668
case GEN_URI:
667669
BIO_puts(bio, "URI:");
668670
as = name->d.uniformResourceIdentifier;
669671
BIO_write(bio, ASN1_STRING_get0_data(as),
670-
ASN1_STRING_length(as));
672+
ASN1_STRING_get_length(as));
671673
break;
672674
default:
673675
/* use builtin print for GEN_OTHERNAME, GEN_X400,

‎ext/openssl/php_openssl_backend.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,11 @@
3737
#include <openssl/pkcs12.h>
3838
#include <openssl/cms.h>
3939

40+
#if OPENSSL_VERSION_NUMBER < 0x40100000L
41+
#define ASN1_STRING_set1_data(str, data, len) ASN1_STRING_set((str), (data), (int) (len))
42+
#define ASN1_STRING_get_length(str) ((size_t) ASN1_STRING_length(str))
43+
#endif
44+
4045
#if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_MAJOR >= 4
4146
typedef const X509_EXTENSION PHP_OPENSSL_X509_EXTENSION;
4247
#else

‎ext/openssl/xp_ssl.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,7 @@ static bool php_openssl_matches_san_list(
478478
/* TODO: warn ? */
479479
continue;
480480
}
481-
if ((size_t)ASN1_STRING_length(san->d.dNSName) != strlen((const char*)cert_name)) {
481+
if (ASN1_STRING_get_length(san->d.dNSName) != strlen((const char*)cert_name)) {
482482
OPENSSL_free(cert_name);
483483
/* prevent null-byte poisoning*/
484484
continue;
@@ -498,7 +498,7 @@ static bool php_openssl_matches_san_list(
498498
}
499499
OPENSSL_free(cert_name);
500500
} else if (san->type == GEN_IPADD) {
501-
if (ASN1_STRING_length(san->d.iPAddress) == 4) {
501+
if (ASN1_STRING_get_length(san->d.iPAddress) == 4) {
502502
snprintf(ipbuffer, sizeof(ipbuffer), "%d.%d.%d.%d",
503503
ASN1_STRING_get0_data(san->d.iPAddress)[0],
504504
ASN1_STRING_get0_data(san->d.iPAddress)[1],
@@ -512,7 +512,7 @@ static bool php_openssl_matches_san_list(
512512
}
513513
}
514514
#ifdef HAVE_IPV6_SAN
515-
else if (ASN1_STRING_length(san->d.ip) == 16 && subject_name_is_ipv6) {
515+
else if (ASN1_STRING_get_length(san->d.ip) == 16 && subject_name_is_ipv6) {
516516
ipbuffer[0] = 0;
517517
EXPAND_IPV6_ADDRESS(ipbuffer, ASN1_STRING_get0_data(san->d.iPAddress));
518518
if (strcasecmp((const char*)subject_name_ipv6_expanded, (const char*)ipbuffer) == 0) {
@@ -568,7 +568,7 @@ static bool php_openssl_matches_common_name(X509 *peer, const char *subject_name
568568
}
569569

570570
name_asn1 = X509_NAME_ENTRY_get_data(name_entry);
571-
cert_name_len = ASN1_STRING_length(name_asn1);
571+
cert_name_len = ASN1_STRING_get_length(name_asn1);
572572
cert_name = (unsigned char *) OPENSSL_strndup((const char *) ASN1_STRING_get0_data(name_asn1), cert_name_len);
573573
if (cert_name == NULL) {
574574
php_error_docref(NULL, E_WARNING, "Unable to locate peer certificate CN");

0 commit comments

Comments
 (0)