Commit:    e3b9b1e6dc016d9128ac5e9ed95aa5b1a5065e5f
Author:    Xinchen Hui <larue...@php.net>         Mon, 9 Jul 2012 00:25:48 +0800
Parents:   a213c10ef2125ac2da7a71ddb668d6f0aea8a05c
Branches:  PHP-5.4

Link:       
http://git.php.net/?p=php-src.git;a=commitdiff;h=e3b9b1e6dc016d9128ac5e9ed95aa5b1a5065e5f

Log:
Fixed Bug #62500 (Segfault in DateInterval class when extended)

This fix also fixed bug #62508  (Segfault while access a non-string
property of DateInterval object)

Bugs:
https://bugs.php.net/62500
https://bugs.php.net/62508

Changed paths:
  M  NEWS
  M  ext/date/php_date.c
  A  ext/date/tests/bug62500.phpt


Diff:
diff --git a/NEWS b/NEWS
index c1ad183..a0763ae 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,9 @@ PHP                                                             
           NEWS
 - SimpleXML:
   . Implemented FR #55218 Get namespaces from current node. (Lonny)
 
+- DateTime:
+  . Fixed Bug #62500 (Segfault in DateInterval class when extended). (Laruence)
+
 ?? ??? 2012, PHP 5.4.5
 
 - Core:
diff --git a/ext/date/php_date.c b/ext/date/php_date.c
index cd48de2..13e7b75 100644
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@@ -3430,10 +3430,19 @@ zval *date_interval_read_property(zval *object, zval 
*member, int type, const ze
                zval_copy_ctor(&tmp_member);
                convert_to_string(&tmp_member);
                member = &tmp_member;
+               key = NULL;
        }
 
        obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+       if (!obj->initialized) {
+               retval = 
(zend_get_std_object_handlers())->read_property(object, member, type, key 
TSRMLS_CC);
+               if (member == &tmp_member) {
+                       zval_dtor(member);
+               }
+               return retval;
+       }
+
 #define GET_VALUE_FROM_STRUCT(n,m)            \
        if (strcmp(Z_STRVAL_P(member), m) == 0) { \
                value = obj->diff->n;                 \
@@ -3482,9 +3491,19 @@ void date_interval_write_property(zval *object, zval 
*member, zval *value, const
                zval_copy_ctor(&tmp_member);
                convert_to_string(&tmp_member);
                member = &tmp_member;
+               key = NULL;
        }
+
        obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+       if (!obj->initialized) {
+               (zend_get_std_object_handlers())->write_property(object, 
member, value, key TSRMLS_CC);
+               if (member == &tmp_member) {
+                       zval_dtor(member);
+               }
+               return;
+       }
+
 #define SET_VALUE_FROM_STRUCT(n,m)            \
        if (strcmp(Z_STRVAL_P(member), m) == 0) { \
                if (value->type != IS_LONG) {         \
diff --git a/ext/date/tests/bug62500.phpt b/ext/date/tests/bug62500.phpt
new file mode 100644
index 0000000..6952332
--- /dev/null
+++ b/ext/date/tests/bug62500.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #62500 (Segfault in DateInterval class when extended)
+--INI--
+date.timezone=GMT
+--FILE--
+<?php
+class Crasher extends DateInterval {
+    public $foo;
+    public function __construct($time_spec) {
+        var_dump($this->foo);
+        $this->foo = 3;
+        var_dump($this->foo);
+        var_dump($this->{2});
+        parent::__construct($time_spec);
+    }
+}
+try {
+    $c = new Crasher('blah');
+} catch (Exception $e) {
+    var_dump($e->getMessage());
+}
+--EXPECTF--
+NULL
+int(3)
+
+Notice: Undefined property: Crasher::$2 in %sbug62500.php on line %d
+NULL
+string(%s) "DateInterval::__construct(): Unknown or bad format (blah)"


--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to