php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69541 mktime() with date.timezone set crashes
Submitted: 2015-04-28 07:09 UTC Modified: 2017-10-05 12:25 UTC
From: kalle@php.net Assigned: derick (profile)
Status: Closed Package: Date/time related
PHP Version: master-Git-2015-04-28 (Git) OS: PHP7
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: kalle@php.net
New email:
PHP Version: OS:

 

 [2015-04-28 07:09 UTC] kalle@php.net
Description:
------------
After the recent tzdb format change, then a simple call to mktime now crashes.

Looking into it a tiny bit shows that the whole magic happens in read_location() (ext/date/lib/parse_tz.c), buffer[2] which is the length of the comments is passed through the timelib_conv_int() macro that then causes the number to be negative, thrus making malloc fail

I did not test against the 5.x versions that was also affected by the db update, but I guess the same problem persists there.

Test script:
---------------
php -r "mktime();" <- No crash

php -d date.timezone=CET -r "mktime();" <- Crash


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-04-28 07:10 UTC] kalle@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: derick
 [2017-10-05 12:25 UTC] nikic@php.net
-Status: Assigned +Status: Closed
 [2017-10-05 12:25 UTC] nikic@php.net
I can't repro, so I assume this was fixed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Dec 27 13:01:27 2024 UTC