From: Anatol Belski <ab@php.net>
Date: Fri, 8 Apr 2016 10:29:40 +0000 (+0200)
Subject: Fixed bug #68893 Stackoverflow in datefmt_create
X-Git-Tag: php-7.0.6RC1~11
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1541a55a4f9207c346a805c2b8d090f16d07f841;p=php

Fixed bug #68893 Stackoverflow in datefmt_create
---

diff --git a/ext/intl/dateformat/dateformat_create.cpp b/ext/intl/dateformat/dateformat_create.cpp
index e90ad74466..8705d4bc0b 100644
--- a/ext/intl/dateformat/dateformat_create.cpp
+++ b/ext/intl/dateformat/dateformat_create.cpp
@@ -36,6 +36,13 @@ extern "C" {
 #include "dateformat_helpers.h"
 #include "zend_exceptions.h"
 
+#define INTL_UDATE_FMT_OK(i) \
+	(UDAT_FULL == (i) || UDAT_LONG == (i) ||    \
+	 UDAT_MEDIUM == (i) || UDAT_SHORT == (i) || \
+	 UDAT_RELATIVE == (i) || UDAT_FULL_RELATIVE == (i) || \
+	 UDAT_LONG_RELATIVE == (i) || UDAT_MEDIUM_RELATIVE == (i) || \
+	 UDAT_SHORT_RELATIVE == (i) || UDAT_NONE == (i) || \
+	 UDAT_PATTERN == (i))
 
 /* {{{ */
 static int datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constructor)
@@ -72,12 +79,6 @@ static int datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constructor)
 		return FAILURE;
     }
 
-	INTL_CHECK_LOCALE_LEN_OR_FAILURE(locale_len);
-	if (locale_len == 0) {
-		locale_str = intl_locale_get_default();
-	}
-	locale = Locale::createFromName(locale_str);
-
 	DATE_FORMAT_METHOD_FETCH_OBJECT_NO_CHECK;
 
 	if (DATE_FORMAT_OBJECT(dfo) != NULL) {
@@ -86,6 +87,21 @@ static int datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constructor)
 		return FAILURE;
 	}
 
+	if (!INTL_UDATE_FMT_OK(date_type)) {
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR, "datefmt_create: invalid date format style", 0);
+		return FAILURE;
+	}
+	if (!INTL_UDATE_FMT_OK(time_type)) {
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR, "datefmt_create: invalid time format style", 0);
+		return FAILURE;
+	}
+
+	INTL_CHECK_LOCALE_LEN_OR_FAILURE(locale_len);
+	if (locale_len == 0) {
+		locale_str = intl_locale_get_default();
+	}
+	locale = Locale::createFromName(locale_str);
+
 	/* process calendar */
 	if (datefmt_process_calendar_arg(calendar_zv, locale, "datefmt_create",
 			INTL_DATA_ERROR_P(dfo), calendar, calendar_type,
diff --git a/ext/intl/tests/dateformat_bug68893.phpt b/ext/intl/tests/dateformat_bug68893.phpt
new file mode 100644
index 0000000000..b3faf54342
--- /dev/null
+++ b/ext/intl/tests/dateformat_bug68893.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #68893 Stackoverflow in datefmt_create
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+$f = datefmt_create("en_us", -10000000, 1); 
+var_dump($f, intl_get_error_message());
+
+$f = datefmt_create("en_us", 1, -10000000); 
+var_dump($f, intl_get_error_message());
+
+?>
+--EXPECT--
+NULL
+string(67) "datefmt_create: invalid date format style: U_ILLEGAL_ARGUMENT_ERROR"
+NULL
+string(67) "datefmt_create: invalid time format style: U_ILLEGAL_ARGUMENT_ERROR"