File php7-CVE-2026-91767.patch of Package php7

From 78cc82b37a340840c6fbff676f513eb4e3d96533 Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Mon, 10 Aug 2026 14:15:35 +0200
Subject: [PATCH] Fix GHSA-xr7j-rvgx-xq5p: OOB read in
 php_openssl_matches_wildcard_name()

The memchr() length underflowed when the wildcard prefix and suffix
overlapped in the subject name (e.g. CN "a*aaaa" against peer name "aaaa").
---
 ext/openssl/tests/GHSA-xr7j-rvgx-xq5p.phpt | 67 ++++++++++++++++++++++
 ext/openssl/xp_ssl.c                       |  5 +-
 2 files changed, 69 insertions(+), 3 deletions(-)
 create mode 100644 ext/openssl/tests/GHSA-xr7j-rvgx-xq5p.phpt

Index: php-7.4.33/ext/openssl/xp_ssl.c
===================================================================
--- php-7.4.33.orig/ext/openssl/xp_ssl.c
+++ php-7.4.33/ext/openssl/xp_ssl.c
@@ -389,8 +389,7 @@ static zend_bool php_openssl_x509_finger
 static zend_bool php_openssl_matches_wildcard_name(const char *subjectname, const char *certname) /* {{{ */
 {
 	char *wildcard = NULL;
-	ptrdiff_t prefix_len;
-	size_t suffix_len, subject_len;
+	size_t prefix_len, suffix_len, subject_len;
 
 	if (strcasecmp(subjectname, certname) == 0) {
 		return 1;
@@ -409,7 +408,7 @@ static zend_bool php_openssl_matches_wil
 
 	suffix_len = strlen(wildcard + 1);
 	subject_len = strlen(subjectname);
-	if (suffix_len <= subject_len) {
+	if (suffix_len + prefix_len <= subject_len) {
 		/* 2) suffix must match
 		 * 3) no . between prefix and suffix
 		 **/