Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88180
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.179 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
Date: Mon, 14 Sep 2015 13:03:35 +0100
Message-ID: <CAEKnhAHGBdx_DZO-Fn5ABan821V_aDFvVDwZDEcSfzfaqTPKqw@mail.gmail.com>
To: PHP internals list <internals@lists.php.net>, Anatol Belski <anatol.php@belski.net>
Content-Type: multipart/alternative; boundary=001a113ec146e3e646051fb3da0d
Subject: Bumping minimal OpenSSL version to 0.9.8
From: bukka@php.net (Jakub Zelenka)

--001a113ec146e3e646051fb3da0d
Content-Type: text/plain; charset=UTF-8

Hi,

At the moment the minimal OpenSSL version is 0.9.6.

I realised yesterday that there are some types changes between 0.9.7 and
0.9.8 that would have to be address in overflow checks (EVP_DigestUpdate
and related). I also noticed that 0.9.6 might not even compile without
warnings as it's checking return type for some function that did not return
anything in 0.9.6. We also have few other old places where we don't check
retval because of that.

The thing is that the last update for 0.9.7 stable branch is in 2008 and
0.9.6 in 2005. Both of them have been long time EOL so I don't think that
it makes any sense to spend any time on making them compatible for PHP 7.
So I think we should bump minimal version to 0.9.8.

Anatol would you be ok if this is done for 7.0? I don't think that anyone
would ever use PHP 7 and such an old version of OpenSSL together so there
should be no issue IMHO.

Cheers

Jakub

--001a113ec146e3e646051fb3da0d--