Thomas confirmed this as working.  Fixed in HEAD and RC4.

Try this patch.  Also, do you have a few sample messages I can use for 
testing?  How did you break the message to get openssl_pkcs7_verify() 
to return -1?

With both cases I meant -1 which means an error during verification, 
and false which means an invalid cert.

I ran a few tests on my own, there is no way to differenciate both 
cases (output is not filled).

If you want to raise two different messages, we need to contact PHP's 
openssl team and ask for a third return code

I suggest that we return two different error messages in those cases.

Then there is a problem in openssl's function :

I wrote the signature function that caused invalid signature 
production and I had two problem : Invalid signature syntax AND 
invalid signature

When facing both problems the function returs -1 as the invalid 
signature is unparsable ... but still invalid

Because, if the signature was really invalid, it would have returned 
false. The commit message that allowed -1 as a valid return, says: 
"openssl_pkcs7_verify returns -1 when the signature is ok but there 
are no certificates to return."

In file framework/Crypt/Crypt/smime.php,v 1.49.2.14 line 215

212:/* Try again without verfying the signer's cert */

213:        $result = openssl_pkcs7_verify($input, PKCS7_NOVERIFY, $output);

214:

215:        if (($result === true) || ($result === -1)) {

216:            [Verification OK]

217:        } else {

218:            [Verification KO]

219:        }



Verification is OK if "$result === -1" but "openssl_pkcs7_verify" 
documentation specify that "[openssl_pkcs7_verify] Returns [...] -1 on 
error."

Why do you consider -1 a valid verification ???



In my case, I had malformed smime signature which lead to an 
encouraging message "valid message verification, but unknown issuer"...