Description:
------------
While reviewing the PHP source code of a third-party application  I stumbled upon the fact that "new DateTimeZone" is not handling the Null-Byte as an error situation.

In this specific case it lead to a vulnerability since the security model was mostly relying on input validation instead of output sanitization (the data was then used in another exploitable context such as not using PDO etc.). Thus I filed this as security relevant bug.
(besides the fact that an actual exploitation obviously requires some other bug in the application as well)

That said, if the PHP team decides that this does not warrant to be handled as security potential issue I'm completely fine with that as the application in question has been fixed.

Test script:
---------------
<?php

function isValidTimeZone($zone) {
	try{
	    new DateTimeZone($zone);
	} catch(Exception $e) {
	    return false;
	}
	return true;
}

var_dump(isValidTimeZone('Europe/Zurich')); // TRUE, as expected
var_dump(isValidTimeZone('Europe/Zurich/Foo')); // False, as expected
var_dump(isValidTimeZone("Europe/Zurich\0Foo")); // True, should be false

Expected result:
----------------
new DateTimeZone("Europe/Zurich\0Foo") should throw an exception

Actual result:
--------------
"Europe/Zurich" is used as timezone