Skip to content

Fix GH-21545: PHP OpenSSL ext: openssl_x509_parse miscalculates validTo_time_t for far-future certificate dates#21591

Open
LamentXU123 wants to merge 2 commits intophp:masterfrom
LamentXU123:fix-openssl
Open

Fix GH-21545: PHP OpenSSL ext: openssl_x509_parse miscalculates validTo_time_t for far-future certificate dates#21591
LamentXU123 wants to merge 2 commits intophp:masterfrom
LamentXU123:fix-openssl

Conversation

@LamentXU123
Copy link
Copy Markdown
Contributor

@LamentXU123 LamentXU123 commented Apr 1, 2026

Fix #21545

After looking at the code closely I think the bug is caused by mktime() here. In Windows, mktime() could only produce time smaller than 2038 or 3000 depending on x32 or x64 system. As the doc reads:

After an adjustment to UTC, _mktime32 handles dates from midnight, January 1, 1970, to 23:59:59 January 18, 2038, UTC. _mktime64 handles dates from midnight, January 1, 1970 to 23:59:59, December 31, 3000. This adjustment may cause these functions to return -1 (cast to time_t, __time32_t or __time64_t) even though the date you specify is within range. For example, if you are in Cairo, Egypt, which is two hours ahead of UTC, two hours will first be subtracted from the date you specify in timeptr; the subtraction may now put your date out of range.

When dealing with far-future certificate dates it suffers from an overflow bug which only appears on Windows.

This patch implement the same function without using mktime()

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PHP OpenSSL ext: openssl_x509_parse miscalculates validTo_time_t for far-future certificate dates

1 participant