Bug #52093 [PATCH]: Openssl_csr_sign (serial)

Edit report at https://bugs.php.net/bug.php?id=52093&edit=1 ID: 52093 Patch added by: cmb@php.net Reported by: dreuzel at belgacom dot net Summary: Openssl_csr_sign (serial) Status: Verified Type: Bug Package: OpenSSL related Operating System: win7 PHP Version: 5.3.2 Assigned To: cmb Block user comment: N Private report: N New Comment: The following pull request has been associated: Patch Name: Fix #52093: openssl_csr_sign silently truncates $serial On GitHub: https://github.com/php/php-src/pull/7209 Patch: https://github.com/php/php-src/pull/7209.patch Previous Comments: ------------------------------------------------------------------------ [2019-08-18 20:35:40] hunterr83 at hotmail dot com Not sure if the same thing, but very related. When I do print(PHP_INT_MAX), I get a value of 9223372036854775807. However, when I try to pass in that value to the serial number parameter, the certificate that is generated shows a serial value of ff, which is 255. Similarly, if I go down one count in value and pass in 9223372036854775806, then I get a final serial number of fe, which is 254. If I pass in 4294967290, then I get fa, which is 250. Some rough testing shows that the maximum value the function is willing to accept is something a bit higher than 4,000,000,000. Once you go above whatever the actual cap is, you start to see some really strange serial numbers. I feel if it's too difficult to support the PHP_INT_MAX value, then we could at least throw an error if the integer being passed in is more than the function can support. ------------------------------------------------------------------------ [2017-08-02 14:27:12] narf at devilix dot net There's a worse problem with this ... It's not even supposed to be a decimal number. ------------------------------------------------------------------------ [2010-06-16 11:34:26] dreuzel at belgacom dot net Description: ------------ The Certificat defintion OpenSSL allows for numerical serial numbers up to 20 positions or more.. In PHP there is build in integer rerstriction only allowing half the serial numbers ..... higher numbers have a cleared part...... The serial needs to be numerical no problem but it need not be an integer or limited by that (allow higher numbers) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=52093&edit=1