Fixed bug #65564 stack-buffer-overflow in DateTimeZone stuff caught by AddressSanitizer

diff --git a/NEWS b/NEWS
index d637d0ac03909b85da60f05e64e4b00a7fe4d1fa..ab1b5caeefc752d968424ade14dae3c1582c454a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,8 @@ PHP                                                                        NEWS
 - Datetime:
   . Fixed bug #65554 (createFromFormat broken when weekday name is followed
     by some delimiters). (Valentin Logvinskiy, Stas).
+  . Fixed bug #65564 (stack-buffer-overflow in DateTimeZone stuff caught
+    by AddressSanitizer). (Remi).
 
 - OPCache:
   . Fixed bug #65561 (Zend Opcache on Solaris 11 x86 needs ZEND_MM_ALIGNMENT=4).

diff --git a/ext/date/php_date.c b/ext/date/php_date.c
index 997038a030d17b8388c2862d0eabbd9546045812..95c68f1a78ca60f73a846fc1ad4b1fa59b2f4e26 100644 (file)
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@@ -2305,7 +2305,7 @@ static HashTable *date_object_get_properties_timezone(zval *object TSRMLS_DC)
 
        MAKE_STD_ZVAL(zv);
        ZVAL_LONG(zv, tzobj->type);
-       zend_hash_update(props, "timezone_type", 14, &zv, sizeof(zval), NULL);
+       zend_hash_update(props, "timezone_type", 14, &zv, sizeof(zv), NULL);
 
        MAKE_STD_ZVAL(zv);
        switch (tzobj->type) {
@@ -2327,7 +2327,7 @@ static HashTable *date_object_get_properties_timezone(zval *object TSRMLS_DC)
                        ZVAL_STRING(zv, tzobj->tzi.z.abbr, 1);
                        break;
        }
-       zend_hash_update(props, "timezone", 9, &zv, sizeof(zval), NULL);
+       zend_hash_update(props, "timezone", 9, &zv, sizeof(zv), NULL);
 
        return props;
 }