php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69541 mktime() with date.timezone set crashes
Submitted: 2015-04-28 07:09 UTC Modified: 2017-10-05 12:25 UTC
From: kalle@php.net Assigned: derick (profile)
Status: Closed Package: Date/time related
PHP Version: master-Git-2015-04-28 (Git) OS: PHP7
Private report: No CVE-ID: None
 [2015-04-28 07:09 UTC] kalle@php.net
Description:
------------
After the recent tzdb format change, then a simple call to mktime now crashes.

Looking into it a tiny bit shows that the whole magic happens in read_location() (ext/date/lib/parse_tz.c), buffer[2] which is the length of the comments is passed through the timelib_conv_int() macro that then causes the number to be negative, thrus making malloc fail

I did not test against the 5.x versions that was also affected by the db update, but I guess the same problem persists there.

Test script:
---------------
php -r "mktime();" <- No crash

php -d date.timezone=CET -r "mktime();" <- Crash


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-04-28 07:10 UTC] kalle@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: derick
 [2017-10-05 12:25 UTC] nikic@php.net
-Status: Assigned +Status: Closed
 [2017-10-05 12:25 UTC] nikic@php.net
I can't repro, so I assume this was fixed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Apr 16 21:01:28 2024 UTC