com php-src: Never return private part of the key from openssl_csr_get_public_key: ext/openssl/openssl.c

Commit: e840071b7653a205d4d00c769cc48f180a5c16b0 Author: Jakub Zelenka <bukka@php.net> Sun, 6 Nov 2016 17:37:06 +0000 Parents: 43df063f9fc41a9f5620435fcfbecc8e7dee9242 Branches: PHP-7.1 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=e840071b7653a205d4d00c769cc48f180a5c16b0 Log: Never return private part of the key from openssl_csr_get_public_key This fixes ecc.phpt test when OpenSSL 1.1 linked. Changed paths: M ext/openssl/openssl.c Diff: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 4bfc03f..528d823 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -3564,7 +3564,22 @@ PHP_FUNCTION(openssl_csr_get_public_key) RETURN_FALSE; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) + /* Due to changes in OpenSSL 1.1 related to locking when decoding CSR, + * the pub key is not changed after assigning. It means if we pass + * a private key, it will be returned including the private part. + * If we duplicate it, then we get just the public part which is + * the same behavior as for OpenSSL 1.0 */ + csr = X509_REQ_dup(csr); +#endif + /* Retrieve the public key from the CSR */ tpubkey = X509_REQ_get_pubkey(csr); + +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) + /* We need to free the CSR as it was duplicated */ + X509_REQ_free(csr); +#endif + if (tpubkey == NULL) { php_openssl_store_errors(); RETURN_FALSE;