From: tranzig at gmail dot com Operating system: PHP version: master-Git-2013-09-18 (Git) Package: OpenSSL related Bug Type: Bug Bug description:certificates validity parsing does not work past 2050
Description: ------------ In asn1_time_to_time_t [ext/openssl/openssl.c], the Y2K bug makes a cameo appearance: [...] *thestr = '\0'; thestr -= 2; thetime.tm_year = atoi(thestr); if (thetime.tm_year < 68) { thetime.tm_year += 100; } This piece of code is the part of a backwards UTCTime parser. It moves 2 positions to the left, and converts those two characters to an int. However, certs with a validity past 2050 contain GeneralizedTime formatted timestamps allowing 4 characters in the year field instead of the UTCTime this function parses (badly). [rfc5280, 4.1.2.5] Test script: --------------- An example script that demonstrates the problem with a cert expiring 2101: http://pastebin.com/Yij0q1qn Expected result: ---------------- Actual time string of validity: 21010828070405Z parsed with strtotime: 4154655845 [2101-08-28] parsed with asn1_time_to_time_t: 4154655845 [2101-08-28] Actual result: -------------- Actual time string of validity: 21010828070405Z parsed with strtotime: 4154655845 [2101-08-28] parsed with asn1_time_to_time_t: 998982245 [2001-08-28] -- Edit bug report at https://bugs.php.net/bug.php?id=65698&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=65698&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=65698&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=65698&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=65698&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=65698&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=65698&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=65698&r=needscript Try newer version: https://bugs.php.net/fix.php?id=65698&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=65698&r=support Expected behavior: https://bugs.php.net/fix.php?id=65698&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=65698&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=65698&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=65698&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=65698&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=65698&r=dst IIS Stability: https://bugs.php.net/fix.php?id=65698&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=65698&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=65698&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=65698&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=65698&r=mysqlcfg