Skip to content

Fix #79015: undefined-behavior in php_date.c #5031

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix #79015: undefined-behavior in php_date.c #5031

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
afc5307
Fix #79015: undefined-behavior in php_date.c
cmb69 Dec 23, 2019
09edc01
Use unserializable payload in test
cmb69 Dec 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions ext/date/php_date.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4389,14 +4389,16 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
PHP_DATE_INTERVAL_READ_PROPERTY("h", h, timelib_sll, -1)
PHP_DATE_INTERVAL_READ_PROPERTY("i", i, timelib_sll, -1)
PHP_DATE_INTERVAL_READ_PROPERTY("s", s, timelib_sll, -1)
do {
{
zval *z_arg = zend_hash_str_find(myht, "f", sizeof("f") - 1);
(*intobj)->diff->us = -1000000;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you pick this value? I see some other code in this file using -99999. @derickr What's the correct value for an unset us?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, it's clear how you picked it: Used in the existing code two lines below... Still, I'm not sure this is the right value, as TIMELIB_UNSET is -99999.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, now I'm confused, since the other properties seem to use -1 as unset default? @derickr, please clarify. Thanks.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm going to look into this when I return from Christmas holiday. Ping me the first week of Jan if I haven't replied yet

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ping ;)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

-1000000 is correct, as in these lines:

4220         if (strcmp(Z_STRVAL_P(member), "f") == 0) {
4221             fvalue = obj->diff->us / 1000000.0;
4222             break;
4223         }

and

4238     if (fvalue != -1) {
4239         ZVAL_DOUBLE(retval, fvalue);

The fvalue ends up being -1 during the division, which would result in FALSE being returned.

if (z_arg) {
(*intobj)->diff->us = ((double)zval_get_double(z_arg) * 1000000);
} else {
(*intobj)->diff->us = (double) -1000000;
double val = zval_get_double(z_arg) * 1000000;
if (val >= 0 && val < 1000000) {
(*intobj)->diff->us = val;
}
}
} while (0);
}
PHP_DATE_INTERVAL_READ_PROPERTY("weekday", weekday, int, -1)
PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
Expand Down
9 changes: 9 additions & 0 deletions ext/date/tests/bug79015.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
--TEST--
Bug #79015 (undefined-behavior in php_date.c)
--FILE--
<?php
var_dump(unserialize('O:12:"DateInterval":1:1s:1:"f";i:9999999999990;'));
?>
--EXPECTF--
Notice: unserialize(): Error at offset 47 of 47 bytes in %s on line %d
bool(false)