Fixed #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs

Squashed commit of the following:

commit a64c1d9bc4
Author: Tomasz Sawicki <falundir@gmail.com>
Date:   Wed Jun 24 08:49:37 2015 +0200

    Fix #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs

    The "key values mismatch" error is triggered in openssl_pkcs12_read by
    PKCS12_parse, because it uses X509_check_private_key to separate main
    certificate (which corresponds to private key) from extra certificates.
    Extra certificates usually comes first (p12 contents are reversed as
    stack) and X509_check_private_key triggers X509_R_KEY_VALUES_MISMATCH
    error.
    The fix pops "key values mismatch" error from OpenSSL error stack for
    each extra certificate if there are any.

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jul 2015, PHP 5.6.12
 
+- OpenSSL:
+  . Fixed bug #69882 (OpenSSL error “key values mismatch” after 
+    openssl_pkcs12_read with extra cert) (Tomasz Sawicki)
+
 09 Jul 2015, PHP 5.6.11
 
 - Core:

ext/openssl/openssl.c

@@ -2575,7 +2575,15 @@ PHP_FUNCTION(openssl_pkcs12_read)
 				zval * zextracert;
 				X509* aCA = sk_X509_pop(ca);
 				if (!aCA) break;
-				
+
+				/* fix for bug 69882 */
+				{
+					int err = ERR_peek_error();
+					if (err == OPENSSL_ERROR_X509_PRIVATE_KEY_VALUES_MISMATCH) {
+						ERR_get_error();
+					}
+				}
+
 				bio_out = BIO_new(BIO_s_mem());
 				if (PEM_write_bio_X509(bio_out, aCA)) {
 					BUF_MEM *bio_buf;

ext/openssl/php_openssl.h

@@ -29,6 +29,8 @@ extern zend_module_entry openssl_module_entry;
 #define OPENSSL_RAW_DATA 1
 #define OPENSSL_ZERO_PADDING 2
 
+#define OPENSSL_ERROR_X509_PRIVATE_KEY_VALUES_MISMATCH 0x0B080074
+
 /* Used for client-initiated handshake renegotiation DoS protection*/
 #define OPENSSL_DEFAULT_RENEG_LIMIT 2
 #define OPENSSL_DEFAULT_RENEG_WINDOW 300

ext/openssl/tests/bug69882.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs
+--SKIPIF--
+<?php
+if (!extension_loaded("openssl")) die("skip");
+?>
+--FILE--
+<?php
+$p12 = file_get_contents(__DIR__.'/p12_with_extra_certs.p12');
+
+$result = openssl_pkcs12_read($p12, $cert_data, 'qwerty');
+var_dump($result);
+var_dump(openssl_error_string());
+?>
+--EXPECTF--
+bool(true)
+bool(false)