Wrong time_t size in Strawberry GCC leads to OpenSSL failures

[chrisnovakovic]

We first noticed this while investigating failures reported by Windows smoke testers in the latest developer release of Net-SSLeay, although we've since been able to reproduce the bug without Net-SSLeay or Perl at all:

https://www.cpantesters.org/cpan/report/11408f94-6c8c-1014-bd64-355a9ee28768
https://www.cpantesters.org/cpan/report/d35ef3c0-6c47-1014-8a31-59579ee28768

OpenSSL's ASN1_* functions behave strangely with 64-bit editions of Windows and the GCC in 32-bit versions of Strawberry Perl >= 5.30.0.1. This MWE should output the current UTC time plus 1 hour:

#include <time.h>
#include <openssl/asn1.h>

int main(void)
{
	ASN1_TIME *tm;
	time_t t;
	BIO *b;

	t = time(NULL);
	tm = ASN1_TIME_adj(NULL, t, 0, 60 * 60);
	b = BIO_new_fp(stdout, BIO_NOCLOSE);
	ASN1_TIME_print(b, tm);
	ASN1_STRING_free(tm);
	BIO_free(b);

	return 0;
}

This outputs the expected result when compiled with the VS compiler, and when compiled with Strawberry Perl 5.28.2.1 x86's GCC. However, with Strawberry Perl 5.30.0.1 x86's GCC:

C:\openssl>date /t
Wed 04/01/2020

C:\openssl>time /t
04:47 PM

C:\openssl>.\asn1_time-5.30.exe
Mar 29 04:28:35 2030 GMT

As you can see, the date is off by almost 10 years.

I brought this up in #win32, and @xenu suggested that it could be down to the introduction of the -D__MINGW_USE_VC2005_COMPAT flag when building OpenSSL, which causes MinGW to use a 64-bit time_t.

[xenu]

I see two ways to fix it, either openssl shouldn't be built with __MINGW_USE_VC2005_COMPAT or strawberry's mingw should be patched to enable that flag by default.

Building perl with that flag without patching mingw is IMO not an option because it may potentially break libraries built for perl using strawberry's mingw but without perl's infrastructure (that is, without the knowledge of %Config)

[kmx]

What would be downsides of building openssl without -D__MINGW_USE_VC2005_COMPAT ?

[h-vn]

Here's more information about what happens with #define __MINGW_USE_VC2005_COMPAT 1 https://stackoverflow.com/a/57902195

In short: it looks like for best results with _MINGW_USE_VC2005_COMPAT also #define __MSVCRT_VERSION__ 0x1400 (or higher) should also be defined.

[kmx]

FYI I am going to build the next openssl binaries without _MINGW_USE_VC2005_COMPAT

[h-vn]

The Net::SSLeay tests now succeed with 32bit Strawberry Perl 5.30.3.1. Also with 32bit 5.32.0.1 the tests pass correctly. Thanks!