From: warwick@imvs.sa.gov.au
Operating system: Linux 6.2 and 7.2
PHP version: 4.1.1
PHP Bug Type: Date/time related
Bug description: date("r") returns wrong timezone offset, can cause crash
I have tested both PHP 4.1.1 and PHP 4.05 and the following occurs for
both.
The date('r') call returns the wrong timezone offset (in my case
"+101800") which causes a buffer overflow in datetime.c
The date("Z") call correctly returns the timezone offset number of seconds
(630 in my case).
The undocumented (in the PHP manual anyway) option to strftime('%z')
returns the correct value of +1030.
The timezone abbreviation ("CST" in my case) is correctly returned with
both the strftime("%Z") and date("T") calls.
This will often cause the process to seg fault and die, althought on more
complex pages, this becomes quite consistant.
With the PHP compile option '--enable-debug', the following is reported in
the Apache error log:
---------------------------------------
zend_execute_API.c(274) : Block 0x0813EDA0 status:
zend_variables.c(44) : Actual location (location was relayed)
Beginning: OK (allocated on datetime.c:331, 32 bytes)
End: Overflown (magic=0x2A8F0030 instead of 0x2A8FCC84)
2 byte(s) overflown
---------------------------------------
For PHP 4.1.1 the configure line is:
./configure --with-mysql=/usr/local/mysql --enable-track-vars
--with-apxs=/usr/local/apache/bin/apxs
--with-config-file-path=/usr/local/apache/conf --enable-bcmath --with-zlib
--with-xml --with-gettext --with-imap=../imap --with-mcrypt
--with-ldap=/usr/local --enable-ftp --without-gd --enable-debug
(Will be used for Horde's IMP webmail system)
--
Edit bug report at http://bugs.php.net/?id=15362&edit=1
--
Fixed in CVS: http://bugs.php.net/fix.php?id=15362&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=15362&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=15362&r=needtrace
Try newer version: http://bugs.php.net/fix.php?id=15362&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=15362&r=support
Expected behavior: http://bugs.php.net/fix.php?id=15362&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=15362&r=notenoughinfo