diff --git a/NEWS b/NEWS index 1d89beaec1ae..c05e1cfe571f 100644 --- a/NEWS +++ b/NEWS @@ -27,6 +27,9 @@ PHP NEWS . Fixed JIT treating an array as packed after a string key write turned it into a hash. (jorgsowa) +- OpenSSL: + . Fixed build with OpenSSL 4.1. (Weilin Du) + - PDO_PGSQL: . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy) diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 0f36f7b42c59..aa02a1ead34d 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -1019,7 +1019,7 @@ PHP_FUNCTION(openssl_spki_new) } if (challenge) { - if (!ASN1_STRING_set(spki->spkac->challenge, challenge, (int)challenge_len)) { + if (!ASN1_STRING_set1_data(spki->spkac->challenge, (const unsigned char *) challenge, challenge_len)) { php_openssl_store_errors(); php_error_docref(NULL, E_WARNING, "Unable to set challenge data"); goto cleanup; diff --git a/ext/openssl/openssl_backend_common.c b/ext/openssl/openssl_backend_common.c index 8ea132a1ab0c..8fb76ee4c0e8 100644 --- a/ext/openssl/openssl_backend_common.c +++ b/ext/openssl/openssl_backend_common.c @@ -72,7 +72,7 @@ void php_openssl_add_assoc_name_entry(zval * val, char * key, const X509_NAME * } else { /* ASN1_STRING_get0_data(3): Since this is an internal pointer it should not be freed or modified in any way */ to_add = ASN1_STRING_get0_data(str); - to_add_len = ASN1_STRING_length(str); + to_add_len = ASN1_STRING_get_length(str); } if (to_add_len != -1) { @@ -107,7 +107,7 @@ void php_openssl_add_assoc_name_entry(zval * val, char * key, const X509_NAME * void php_openssl_add_assoc_asn1_string(zval * val, char * key, const ASN1_STRING * str) { - add_assoc_stringl(val, key, (const char *)ASN1_STRING_get0_data(str), ASN1_STRING_length(str)); + add_assoc_stringl(val, key, (const char *)ASN1_STRING_get0_data(str), ASN1_STRING_get_length(str)); } time_t php_openssl_asn1_time_to_time_t(ASN1_UTCTIME * timestr) @@ -131,7 +131,7 @@ time_t php_openssl_asn1_time_to_time_t(ASN1_UTCTIME * timestr) return (time_t)-1; } - timestr_len = (size_t)ASN1_STRING_length(timestr); + timestr_len = ASN1_STRING_get_length(timestr); if (timestr_len != strlen((const char *)ASN1_STRING_get0_data(timestr))) { php_error_docref(NULL, E_WARNING, "Illegal length in timestamp"); @@ -636,7 +636,7 @@ int openssl_x509v3_subjectAltName(BIO *bio, PHP_OPENSSL_X509_EXTENSION *extensio extension_data = X509_EXTENSION_get_data(extension); p = ASN1_STRING_get0_data(extension_data); - length = ASN1_STRING_length(extension_data); + length = ASN1_STRING_get_length(extension_data); if (method->it) { names = (GENERAL_NAMES*) (ASN1_item_d2i(NULL, &p, length, ASN1_ITEM_ptr(method->it))); @@ -658,19 +658,19 @@ int openssl_x509v3_subjectAltName(BIO *bio, PHP_OPENSSL_X509_EXTENSION *extensio BIO_puts(bio, "email:"); as = name->d.rfc822Name; BIO_write(bio, ASN1_STRING_get0_data(as), - ASN1_STRING_length(as)); + ASN1_STRING_get_length(as)); break; case GEN_DNS: BIO_puts(bio, "DNS:"); as = name->d.dNSName; BIO_write(bio, ASN1_STRING_get0_data(as), - ASN1_STRING_length(as)); + ASN1_STRING_get_length(as)); break; case GEN_URI: BIO_puts(bio, "URI:"); as = name->d.uniformResourceIdentifier; BIO_write(bio, ASN1_STRING_get0_data(as), - ASN1_STRING_length(as)); + ASN1_STRING_get_length(as)); break; default: /* use builtin print for GEN_OTHERNAME, GEN_X400, diff --git a/ext/openssl/php_openssl_backend.h b/ext/openssl/php_openssl_backend.h index fcbb8d42542f..364f27eec23e 100644 --- a/ext/openssl/php_openssl_backend.h +++ b/ext/openssl/php_openssl_backend.h @@ -35,6 +35,11 @@ #include #include +#if OPENSSL_VERSION_NUMBER < 0x40100000L +#define ASN1_STRING_set1_data(str, data, len) ASN1_STRING_set((str), (data), (int) (len)) +#define ASN1_STRING_get_length(str) ((size_t) ASN1_STRING_length(str)) +#endif + #if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_MAJOR >= 4 typedef const X509_EXTENSION PHP_OPENSSL_X509_EXTENSION; #else diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c index ad06af444ffe..5cead037715a 100644 --- a/ext/openssl/xp_ssl.c +++ b/ext/openssl/xp_ssl.c @@ -541,7 +541,7 @@ static bool php_openssl_matches_san_list( /* TODO: warn ? */ continue; } - if ((size_t)ASN1_STRING_length(san->d.dNSName) != strlen((const char*)cert_name)) { + if (ASN1_STRING_get_length(san->d.dNSName) != strlen((const char*)cert_name)) { OPENSSL_free(cert_name); /* prevent null-byte poisoning*/ continue; @@ -561,7 +561,7 @@ static bool php_openssl_matches_san_list( } OPENSSL_free(cert_name); } else if (san->type == GEN_IPADD) { - if (ASN1_STRING_length(san->d.iPAddress) == 4) { + if (ASN1_STRING_get_length(san->d.iPAddress) == 4) { snprintf(ipbuffer, sizeof(ipbuffer), "%d.%d.%d.%d", ASN1_STRING_get0_data(san->d.iPAddress)[0], ASN1_STRING_get0_data(san->d.iPAddress)[1], @@ -575,7 +575,7 @@ static bool php_openssl_matches_san_list( } } #ifdef HAVE_IPV6_SAN - else if (ASN1_STRING_length(san->d.ip) == 16 && subject_name_is_ipv6) { + else if (ASN1_STRING_get_length(san->d.ip) == 16 && subject_name_is_ipv6) { ipbuffer[0] = 0; EXPAND_IPV6_ADDRESS(ipbuffer, ASN1_STRING_get0_data(san->d.iPAddress)); if (strcasecmp((const char*)subject_name_ipv6_expanded, (const char*)ipbuffer) == 0) { @@ -630,7 +630,7 @@ static bool php_openssl_matches_common_name(php_stream *stream, const X509 *peer return false; } name_asn1 = X509_NAME_ENTRY_get_data(name_entry); - cert_name_len = ASN1_STRING_length(name_asn1); + cert_name_len = ASN1_STRING_get_length(name_asn1); cert_name = (unsigned char *) OPENSSL_strndup((const char *) ASN1_STRING_get0_data(name_asn1), cert_name_len); if (cert_name == NULL) { php_stream_warn(stream, NetworkRecvFailed, "Unable to locate peer certificate CN");