Segmentation fault (access null pointer) in ext/date/lib/parse_tz.c

[YuanchengJiang]

Description

The following code:

<?php
class MyDateTimeZone extends DateTimeZone
{
function __construct()
{
}
}
$mdtz = new MyDateTimeZone();
$fusion = $mdtz;
$d[] = date_create("2005-07-14 22:30:41", $fusion);
foreach($d as $date) {
echo $date->format(DateTime::ISO8601), "\n";
}

Resulted in this output:

/php-src/ext/date/lib/parse_tz.c:800:11: runtime error: member access within null pointer of type 'timelib_tzinfo' (aka 'struct _timelib_tzinfo')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/date/lib/parse_tz.c:800:11

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[nielsdos]

Slightly simplified:

<?php
class MyDateTimeZone extends DateTimeZone
{
    function __construct()
    {
    }
}
$date = date_create("2005-07-14 22:30:41", new MyDateTimeZone);
echo $date->format(DateTime::ISO8601), "\n";

This also happens using Reflection when making an uninitialized DateTimeZone:

<?php
$rc = new ReflectionClass('DateTimeZone');
$date = date_create("2005-07-14 22:30:41", $rc->newInstanceWithoutConstructor());
echo $date->format(DateTime::ISO8601), "\n";

[cmb69]

I'm actually surprised that this apparently hasn't been reported before.

Anyhow, what about initializing DateTimeZone objects with the default timezone prior to running the constructor?

[nielsdos]

That's kinda unexpected imo in the sense that it can hide bugs.
I would just opt to add checks for the initialized field, which is similar to how some date objects are already checked.

[derickr]

It wasn't as simple as that, but it's fixed now!