php / php/php-src

PHP OpenSSL ext: openssl_x509_parse miscalculates validTo_time_t for far-future certificate dates

未关闭
#21,545 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

Bug Extension: openssl Status: Needs Triage
主要语言
C
星标
40.4k
派生
8.1k
平均合并
2 天 13 小时
30 天内合并 PR
96

描述

Description

Used (example) certificate:

-----BEGIN CERTIFICATE-----
MIIGWTCCBEGgAwIBAgIUBcY8ibywJ2UhL+Zc8LideouWo4QwDQYJKoZIhvcNAQEL
BQAwgboxCzAJBgNVBAYTAkRFMQswCQYDVQQIDAJCWTEPMA0GA1UEBwwGTXVuaWNo
MRgwFgYDVQQKDA9Bd2Vzb21lIENvbXBhbnkxGjAYBgNVBAsMEUNFTyBvZiBHdW1t
aWJlYXJzMR0wGwYDVQQDDBRNZW50b3Igb2YgdGhlIEp1bmdsZTE4MDYGCSqGSIb3
DQEJARYpYmFnaGVlcmFAbG9va2ZvcnRoZWJhcmVuZWNlc3NpdGllcy5qdW5nbGUw
IBcNMjYwMzI3MDgyNzU1WhgPNTAyNDAzMzAwODI3NTVaMIG6MQswCQYDVQQGEwJE
RTELMAkGA1UECAwCQlkxDzANBgNVBAcMBk11bmljaDEYMBYGA1UECgwPQXdlc29t
ZSBDb21wYW55MRowGAYDVQQLDBFDRU8gb2YgR3VtbWliZWFyczEdMBsGA1UEAwwU
TWVudG9yIG9mIHRoZSBKdW5nbGUxODA2BgkqhkiG9w0BCQEWKWJhZ2hlZXJhQGxv
b2tmb3J0aGViYXJlbmVjZXNzaXRpZXMuanVuZ2xlMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEA1+YbK8mmUNAgNnI/uDC9GCmxn8grLjLnHay2tBu0tRWj
BRSIRog2coW1jFcUugiPjhUz+01l4lokplr46TjM5d31upuOz50MJGsP5zDYrUZC
AIQIBFKIJPyMh3LQr5qztZ9UD3RRix9o8nr27HDx6rtUsFia2r6H3GSZHkvuRKVb
hQQOYVkOvYo59VrN4+sSrLPiXAHwJJlMmRijtthtmKFIYIInTlQTwDnlrnsonKoI
7dCk6Hil4uh3wJA2KKO5OP1SIv/z6Fx5VOrGTajzu1BHd8IW13pf+sJCR1ArkxRv
9goeMubYPyZTbWvL12++tP3mkeA1frmDPCnmheHORY1w2MIhAtH75LU+W/ES7yRx
vwZS2JNly2NgCrIo/23mnhukxhUnwXmY1zjXJ+4kBqzRAQeVT6VJPR0SmdchBcFF
kIoMUu4fcXynADAD6r/uzXbELfkrKohpeboIaRbDdiRdGnM7EYFmg1pSb5AlDhKo
N2N6FiZTw47ABfROGJbzFJZtxHXHMzqr0LgUmvmwC5yn3vN1nSpo1fq6QJgiKp5K
0X4fNWpXwJWlNOVKVnMZlbiYBTvrXXtx8hPqwthiheDpPQmw3z/vnTt1+XVarkrh
E/iFZrE3T9YCceGk7FJ0Gp41UOMsAT6qGkqD1hbp0bBBIcqZ5CK9dUwKnmj7X8EC
AwEAAaNTMFEwHQYDVR0OBBYEFDA1JzPwZtWPiyTRPu57EOS/LByGMB8GA1UdIwQY
MBaAFDA1JzPwZtWPiyTRPu57EOS/LByGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
hvcNAQELBQADggIBAMHVbOTul9jeZG/JmSNNksOaCCdP0JDqFZrIA3f8xRSkcwdG
KNHvCObdzAY2JXMedL5fqF6IM4pyKV7xX70HM5gFHMl2w26uCvihibLxHRGx5DvL
Ylrk96b1AVguFGUzHsEq6qBI8b2TuBzh+ltfus5cUBrFAr9g3l3ZLnHZiGtz82IB
09LVkEI+zK7cLOooQVhSmTLMRtEa/LqJ5FQ9cdyB+fXzylUwknB99vIGSkNSOvuj
dAsJcEIeYa0Ysfmju0VCm1sC47AP8LLz0kCg9EYcE9VIKiImkFzjNvH5dcGkKnZp
fTJ7aFqOgTScFmc+1sOvK/a6CsThwC6qKYu/osEdpdj8W82DznQ9kPMTW1S0Wnm9
OlhYy/nQjNs67ibiiyJV9KGor864Q/87QZ152s6s0Q6Q7sur+6rH/WOh3CtM+37b
VISKDcFsN5OrtNsehPEvsgZrEIgej/9kPEADU87wDIUXmsl3LoVk7xdA7fVoA1Lf
Ok6xTaHcR3OQYNn7kH0z5Aitx/uDaHDUJtqMQUJjhhMfGgr0DV83OlRQX0xpmpck
cgr1J/J5nhmsh/rE7rCx3N0ZOfAhdtGUd7xr0QZaKemk+E2upziIPbSdU8egjIVs
cMXlpIpW+6hS7yPKl5RtH3hUroHkI/yQDifFVzAV8ciDSNt1l9KVODp97lMk
-----END CERTIFICATE-----

The following code:

$cert = openssl_x509_parse(file_get_contents(__DIR__ . DIRECTORY_SEPARATOR. "cert.pem"));

# remove some fields to reduce output length
unset ($cert["purposes"]);
unset ($cert["extensions"]);

print_r($cert);

Resulted in this output:

Array
(
    [name] => /C=DE/ST=BY/L=Munich/O=Awesome Company/OU=CEO of Gummibears/CN=Mentor of the Jungle/emailAddress=bagheera@lookforthebarenecessities.jungle
    [subject] => Array
        (
            [C] => DE
            [ST] => BY
            [L] => Munich
            [O] => Awesome Company
            [OU] => CEO of Gummibears
            [CN] => Mentor of the Jungle
            [emailAddress] => bagheera@lookforthebarenecessities.jungle
        )

    [hash] => ca43115b
    [issuer] => Array
        (
            [C] => DE
            [ST] => BY
            [L] => Munich
            [O] => Awesome Company
            [OU] => CEO of Gummibears
            [CN] => Mentor of the Jungle
            [emailAddress] => bagheera@lookforthebarenecessities.jungle
        )

    [version] => 2
    [serialNumber] => 0x05C63C89BCB02765212FE65CF0B89D7A8B96A384
    [serialNumberHex] => 05C63C89BCB02765212FE65CF0B89D7A8B96A384
    [validFrom] => 260327082755Z
    [validTo] => 50240330082755Z
    [validFrom_time_t] => 1774600075
    [validTo_time_t] => 7199
    [signatureTypeSN] => RSA-SHA256
    [signatureTypeLN] => sha256WithRSAEncryption
    [signatureTypeNID] => 668
)

But I expected this output instead:

Array
(
    [name] => /C=DE/ST=BY/L=Munich/O=Awesome Company/OU=CEO of Gummibears/CN=Mentor of the Jungle/emailAddress=bagheera@lookforthebarenecessities.jungle
    [subject] => Array
        (
            [C] => DE
            [ST] => BY
            [L] => Munich
            [O] => Awesome Company
            [OU] => CEO of Gummibears
            [CN] => Mentor of the Jungle
            [emailAddress] => bagheera@lookforthebarenecessities.jungle
        )

    [hash] => ca43115b
    [issuer] => Array
        (
            [C] => DE
            [ST] => BY
            [L] => Munich
            [O] => Awesome Company
            [OU] => CEO of Gummibears
            [CN] => Mentor of the Jungle
            [emailAddress] => bagheera@lookforthebarenecessities.jungle
        )

    [version] => 2
    [serialNumber] => 0x05C63C89BCB02765212FE65CF0B89D7A8B96A384
    [serialNumberHex] => 05C63C89BCB02765212FE65CF0B89D7A8B96A384
    [validFrom] => 260327082755Z
    [validTo] => 50240330082755Z
    [validFrom_time_t] => 1774600075
    [validTo_time_t] => 96382600075
    [signatureTypeSN] => RSA-SHA256
    [signatureTypeLN] => sha256WithRSAEncryption
    [signatureTypeNID] => 668
)
PHP Version
PHP 8.5.4 (cli) (built: Mar 10 2026 23:30:42) (ZTS Visual C++ 2022 x64)
Copyright (c) The PHP Group
Built by The PHP Group
Zend Engine v4.5.4, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.4, Copyright (c), by Zend Technologies
Operating System

Windows 11, Windows Server 20xx

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

调研方向

在 PHP 8.5.4 上使用 cert.pem 证书和 openssl_x509_parse() 入口点重现该问题。检查 PHP OpenSSL 扩展对证书日期 validTo 的处理，然后验证 validTo_time_t 表示预期输出中显示的遥远未来值，并确认现有的证书解析行为保持不变。

由索引模型根据 Issue 内容生成。

评估

技术栈
c, php
领域
backend, security
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。