Bug #52093 [Com]: openssl_csr_sign truncates $serial

Edit report at https://bugs.php.net/bug.php?id=52093&edit=1 ID: 52093 Comment by: izorkin at elven dot pw Reported by: dreuzel at belgacom dot net Summary: openssl_csr_sign truncates $serial Status: Closed Type: Bug Package: OpenSSL related Operating System: win7 PHP Version: 5.3.2 Assigned To: cmb Block user comment: N Private report: N New Comment: After this patch error build php 7.4 and php 8.0: ``` /build/php-src-7.4.22/ext/openssl/openssl.c: In function 'zif_openssl_csr_sign': /build/php-src-7.4.22/ext/openssl/openssl.c:3528:2: warning: implicit declaration of function 'ASN1_INTEGER_set_int64'; did you mean 'ASN1_INTEGER_set'? [^[]8;;https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wimplicit-function-declaration^G-Wimplicit-function-declaration^[]8;;^G] 3528 | ASN1_INTEGER_set_int64(X509_get_serialNumber(new_cert), serial); | ^~~~~~~~~~~~~~~~~~~~~~ | ASN1_INTEGER_set ``` Use Openssl version 1.1.1k. Previous Comments: ------------------------------------------------------------------------ [2021-07-01 13:46:42] git@php.net Automatic comment on behalf of cmb69 Revision: https://github.com/php/php-src/commit/334387bb7097840789fbc95bd38c425645705d30 Log: Fix #52093: openssl_csr_sign truncates $serial ------------------------------------------------------------------------ [2021-06-30 12:37:31] cmb@php.net The following pull request has been associated: Patch Name: Fix #52093: openssl_csr_sign silently truncates $serial On GitHub: https://github.com/php/php-src/pull/7209 Patch: https://github.com/php/php-src/pull/7209.patch ------------------------------------------------------------------------ [2019-08-18 20:35:40] hunterr83 at hotmail dot com Not sure if the same thing, but very related. When I do print(PHP_INT_MAX), I get a value of 9223372036854775807. However, when I try to pass in that value to the serial number parameter, the certificate that is generated shows a serial value of ff, which is 255. Similarly, if I go down one count in value and pass in 9223372036854775806, then I get a final serial number of fe, which is 254. If I pass in 4294967290, then I get fa, which is 250. Some rough testing shows that the maximum value the function is willing to accept is something a bit higher than 4,000,000,000. Once you go above whatever the actual cap is, you start to see some really strange serial numbers. I feel if it's too difficult to support the PHP_INT_MAX value, then we could at least throw an error if the integer being passed in is more than the function can support. ------------------------------------------------------------------------ [2017-08-02 14:27:12] narf at devilix dot net There's a worse problem with this ... It's not even supposed to be a decimal number. ------------------------------------------------------------------------ [2010-06-16 11:34:26] dreuzel at belgacom dot net Description: ------------ The Certificat defintion OpenSSL allows for numerical serial numbers up to 20 positions or more.. In PHP there is build in integer rerstriction only allowing half the serial numbers ..... higher numbers have a cleared part...... The serial needs to be numerical no problem but it need not be an integer or limited by that (allow higher numbers) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=52093&edit=1