[php-src] master: Merge branch 'PHP-8.6'

Author: Jakub Zelenka (bukka) Date: 2026-10-01T18:19:25+02:00 Commit: https://github.com/php/php-src/commit/1864bd94d816d22b70533c480b8310ba9197bab3 Raw diff: https://github.com/php/php-src/commit/1864bd94d816d22b70533c480b8310ba9197bab3.diff Merge branch 'PHP-8.6' * PHP-8.6: openssl_sign - restore default salt length without passing salt_length parameter (#24033) Changed paths: A ext/openssl/tests/openssl_sign_pss_default_salt_length.phpt M ext/openssl/openssl.c Diff: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index b05ee7418d0c..1c1ca4a2a614 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -4514,6 +4514,11 @@ static zend_result php_openssl_setup_rsa_pss_salt_length(EVP_PKEY_CTX *pctx, EVP return SUCCESS; } + /* For AUTO, keep the OpenSSL default salt length. */ + if (salt_length == RSA_PSS_SALTLEN_AUTO) { + return SUCCESS; + } + /* Only apply to RSA keys */ if (EVP_PKEY_base_id(pkey) != EVP_PKEY_RSA && EVP_PKEY_base_id(pkey) != EVP_PKEY_RSA_PSS) { return SUCCESS; diff --git a/ext/openssl/tests/openssl_sign_pss_default_salt_length.phpt b/ext/openssl/tests/openssl_sign_pss_default_salt_length.phpt new file mode 100644 index 000000000000..6042371c28c4 --- /dev/null +++ b/ext/openssl/tests/openssl_sign_pss_default_salt_length.phpt @@ -0,0 +1,20 @@ +--TEST-- +openssl_sign() with RSA-PSS uses the digest length as the default salt length (OpenSSL >= 3.1) +--EXTENSIONS-- +openssl +--SKIPIF-- +<?php +if (OPENSSL_VERSION_NUMBER < 0x30100000) die('skip For OpenSSL >= 3.1'); +?> +--FILE-- +<?php +$data = "Testing openssl_sign() with RSA-PSS"; +$privkey = "file://" . __DIR__ . "/private_rsa_1024.key"; +$pubkey = "file://" . __DIR__ . "/public.key"; + +var_dump(openssl_sign($data, $sign, $privkey, OPENSSL_ALGO_SHA256, OPENSSL_PKCS1_PSS_PADDING)); +var_dump(openssl_verify($data, $sign, $pubkey, OPENSSL_ALGO_SHA256, OPENSSL_PKCS1_PSS_PADDING, OPENSSL_RSA_PSS_SALTLEN_DIGEST)); +?> +--EXPECT-- +bool(true) +int(1)