Re: Re: com php-src: Fixed bug #67118 DateTime constructor crash with invalid data: NEWS ext/date/php_date.c ext/date/tests/bug67118.phpt
| From: | Anatol Belski | Date: | Wed, 04 Jun 2014 22:36:48 +0000 |
| Subject: | Re: Re: com php-src: Fixed bug #67118 DateTime constructor crash with invalid data: NEWS ext/date/php_date.c ext/date/tests/bug67118.phpt | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-74749@lists.php.net to get a copy of this message | ||
Hi Remi,
On Wed, June 4, 2014 20:41, Remi Collet wrote:
> Le 04/06/2014 20:25, Remi Collet a écrit :
>
>> Le 25/04/2014 17:23, Anatol Belski a écrit :
>>
>>> Commit: c1aa9baf29d1a20fa60c1cef3979a80014f6677b
>>> Author: Anatol Belski <ab@php.net> Fri, 25 Apr 2014
>>> 17:23:26
>>> +0200
>>> Parents: 03c703b8bd55679edf30fe17529fab0c2281b01f
>>> Branches: PHP-5.4 PHP-5.5 PHP-5.6 master
>>>
>>>
>>> Link:
>>>
>>> http://git.php.net/?p=php-src.git;a=commitdiff;h=c1aa9baf29d1a20fa60c1
>>> cef3979a80014f6677b
>>
>>
>> It seems this fix breaks Horde (Horde_Imap_Client).
>>
>>
>> Here is the code:
>>
>>
>>
>> https://github.com/horde/horde/blob/master/framework/Imap_Client/lib/Ho
>> rde/Imap/Client/DateTime.php
>>
>> If first __construct call fails, this=NULL and other call have no
>> effect.
>>
>> Probably the code seems a bit ugly... but...
>>
>>
>> Any idea ?
>> - realloc "this" before php_date_initialize ?
>>
>>
>> Remi.
>>
>>
>>
>
> Simple reproducer:
>
>
> <?php
>
>
> class Foo extends DateTime { public function __construct($time = null) {
> $tz = new DateTimeZone('UTC');
> try { echo "First try\n"; parent::__construct($time, $tz);
> return; } catch (Exception $e) {
> echo "Second try\n"; parent::__construct($time.'C', $tz);
> }
> }
> }
> $date = '12 Sep 2007 15:49:12 UT';
> var_dump(new Foo($date));
>
Oh god, why in the world do they have a return there, if they intend to
retry with a corrected string :) Yes, the string '12 Sep 2007 15:49:12 UT'
is invalid and timelib would complain about the nonexistent timezone, then
the script will jump out on that first return.
Prior to this fix, no check for php_date_initialize() was done, means the
object was created in anyway. And the strange thing is, that timelib
returns 0 (means error) but indeed could parse that invalid string. So
looking how to unite those two contrasts now. Thanks for the info.
Regards
Anatol