Fixed Bug #62500 (Segfault in DateInterval class when extended)

This fix also fixed bug #62508  (Segfault while access a non-string
property of DateInterval object)

diff --git a/NEWS b/NEWS
index c1ad1837d89bcf3bb0ab644287317c78da613a9e..a0763aeb126f0f5884f4f049ca54cc8971ebaba9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,9 @@ PHP                                                                        NEWS
 - SimpleXML:
   . Implemented FR #55218 Get namespaces from current node. (Lonny)
 
+- DateTime:
+  . Fixed Bug #62500 (Segfault in DateInterval class when extended). (Laruence)
+
 ?? ??? 2012, PHP 5.4.5
 
 - Core:

diff --git a/ext/date/php_date.c b/ext/date/php_date.c
index cd48de2731bdb0426aefd0edaa6a042d5a33237c..13e7b753d38fa9c2c80b9d18c65751584c1d6292 100644 (file)
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@@ -3430,10 +3430,19 @@ zval *date_interval_read_property(zval *object, zval *member, int type, const ze
                zval_copy_ctor(&tmp_member);
                convert_to_string(&tmp_member);
                member = &tmp_member;
+               key = NULL;
        }
 
        obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+       if (!obj->initialized) {
+               retval = (zend_get_std_object_handlers())->read_property(object, member, type, key TSRMLS_CC);
+               if (member == &tmp_member) {
+                       zval_dtor(member);
+               }
+               return retval;
+       }
+
 #define GET_VALUE_FROM_STRUCT(n,m)            \
        if (strcmp(Z_STRVAL_P(member), m) == 0) { \
                value = obj->diff->n;                 \
@@ -3482,9 +3491,19 @@ void date_interval_write_property(zval *object, zval *member, zval *value, const
                zval_copy_ctor(&tmp_member);
                convert_to_string(&tmp_member);
                member = &tmp_member;
+               key = NULL;
        }
+
        obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+       if (!obj->initialized) {
+               (zend_get_std_object_handlers())->write_property(object, member, value, key TSRMLS_CC);
+               if (member == &tmp_member) {
+                       zval_dtor(member);
+               }
+               return;
+       }
+
 #define SET_VALUE_FROM_STRUCT(n,m)            \
        if (strcmp(Z_STRVAL_P(member), m) == 0) { \
                if (value->type != IS_LONG) {         \

diff --git a/ext/date/tests/bug62500.phpt b/ext/date/tests/bug62500.phpt
new file mode 100644 (file)
index 0000000..6952332
--- /dev/null
+++ b/ext/date/tests/bug62500.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #62500 (Segfault in DateInterval class when extended)
+--INI--
+date.timezone=GMT
+--FILE--
+<?php
+class Crasher extends DateInterval {
+    public $foo;
+    public function __construct($time_spec) {
+        var_dump($this->foo);
+        $this->foo = 3;
+        var_dump($this->foo);
+        var_dump($this->{2});
+        parent::__construct($time_spec);
+    }
+}
+try {
+    $c = new Crasher('blah');
+} catch (Exception $e) {
+    var_dump($e->getMessage());
+}
+--EXPECTF--
+NULL
+int(3)
+
+Notice: Undefined property: Crasher::$2 in %sbug62500.php on line %d
+NULL
+string(%s) "DateInterval::__construct(): Unknown or bad format (blah)"