From 9bfe53c743863fa022c543bd95b68f169c19d95c Mon Sep 17 00:00:00 2001
From: Chris Orlando <chrsorlando@gmail.com>
Date: Thu, 12 Nov 2026 09:57:08 -0500
Subject: [PATCH] Fix GH-25402: ext/openssl build failure against OpenSSL 1.0.2

19255f4b78 ("Backport compatibility changes for OpenSSL 4.0") switched
the IP SAN matching in php_openssl_matches_san_list() to
ASN1_STRING_get0_data(), which was only added in OpenSSL 1.1.0. PHP 8.2
and 8.3 still support OpenSSL 1.0.2, and openssl.c already carries a
fallback for it, but that one is static to openssl.c, so xp_ssl.c no
longer compiled against 1.0.2.

Add the equivalent fallback to xp_ssl.c under the same
PHP_OPENSSL_API_VERSION < 0x10100 guard.
---
 NEWS                 | 4 +++-
 ext/openssl/xp_ssl.c | 4 ++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index ad524d0bb94c..1004f784e3f4 100644
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.2.36
 
-
+- OpenSSL:
+  . Fixed bug GH-25402 (Build fails against OpenSSL 1.0.2 due to missing
+    ASN1_STRING_get0_data() in xp_ssl.c). (Chris Orlando)
 
 21 Oct 2026, PHP 8.2.35
 
diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
index cc0f53898abc..e2aecdf8ac7f 100644
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -36,6 +36,10 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#if PHP_OPENSSL_API_VERSION < 0x10100
+# define ASN1_STRING_get0_data(asn1) ((const unsigned char *)M_ASN1_STRING_data(asn1))
+#endif
+
 #ifdef PHP_WIN32
 #include "win32/winutil.h"
 #include "win32/time.h"