Skip to content

Commit

Permalink
Fix #81500: Interval serialization regression since 7.3.14 / 7.4.2
Browse files Browse the repository at this point in the history
While it may not be desired, `DateInterval::$f` supports negative
values, at least with regard to calculations.  We still need to guard
from assigning double values which are out of range for signed 64bit
integers (which would be undefined behavior).  zend_dval_to_lval() does
this by returning `0` instead of triggering UB.  This way we can avoid
setting the invalid marker, which doesn't work as expected anyway.

We must not do that only for unserialization, but also when the property
is set in the first place.

We need to adapt some of the existing tests wrt. this behavior.  In
particular, we check for an arbitrary value in bug79015.phpt, to cater
to differences between 32bit and 64bit architectures.

Closes GH-7575.
  • Loading branch information
cmb69 committed Oct 15, 2021
1 parent 3657693 commit 866adb1
Show file tree
Hide file tree
Showing 8 changed files with 27 additions and 11 deletions.
4 changes: 4 additions & 0 deletions NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ PHP NEWS
. Fixed bug #81518 (Header injection via default_mimetype / default_charset).
(cmb)

- Date:
. Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
(cmb)

- MySQLi:
. Fixed bug #81494 (Stopped unbuffered query does not throw error). (Nikita)

Expand Down
8 changes: 2 additions & 6 deletions ext/date/php_date.c
Original file line number Diff line number Diff line change
Expand Up @@ -4331,7 +4331,7 @@ static zval *date_interval_write_property(zval *object, zval *member, zval *valu
SET_VALUE_FROM_STRUCT(i, "i");
SET_VALUE_FROM_STRUCT(s, "s");
if (strcmp(Z_STRVAL_P(member), "f") == 0) {
obj->diff->us = zval_get_double(value) * 1000000;
obj->diff->us = zend_dval_to_lval(zval_get_double(value) * 1000000.0);
break;
}
SET_VALUE_FROM_STRUCT(invert, "invert");
Expand Down Expand Up @@ -4468,12 +4468,8 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
PHP_DATE_INTERVAL_READ_PROPERTY("s", s, timelib_sll, -1)
{
zval *z_arg = zend_hash_str_find(myht, "f", sizeof("f") - 1);
(*intobj)->diff->us = -1000000;
if (z_arg) {
double val = zval_get_double(z_arg) * 1000000;
if (val >= 0 && val < 1000000) {
(*intobj)->diff->us = val;
}
(*intobj)->diff->us = zend_dval_to_lval(zval_get_double(z_arg) * 1000000.0);
}
}
PHP_DATE_INTERVAL_READ_PROPERTY("weekday", weekday, int, -1)
Expand Down
2 changes: 1 addition & 1 deletion ext/date/tests/bug53437_var3.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,6 @@ object(DateInterval)#%d (16) {
["have_special_relative"]=>
int(0)
["f"]=>
float(-1)
float(0)
}
==DONE==
2 changes: 1 addition & 1 deletion ext/date/tests/bug53437_var5.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,6 @@ object(DateInterval)#%d (16) {
["have_special_relative"]=>
int(0)
["f"]=>
float(-1)
float(0)
}
==DONE==
2 changes: 1 addition & 1 deletion ext/date/tests/bug73091.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ object(DateInterval)#%d (16) {
["s"]=>
int(-1)
["f"]=>
float(-1)
float(0)
["weekday"]=>
int(-1)
["weekday_behavior"]=>
Expand Down
2 changes: 1 addition & 1 deletion ext/date/tests/bug79015.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ object(DateInterval)#%d (16) {
["s"]=>
int(0)
["f"]=>
float(-1)
float(%f)
["weekday"]=>
int(0)
["weekday_behavior"]=>
Expand Down
16 changes: 16 additions & 0 deletions ext/date/tests/bug81500.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
--TEST--
Bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2)
--FILE--
<?php
$interval = new DateInterval('PT1S');
$interval->f = -0.000001;
var_dump($interval->s, $interval->f);

$interval = unserialize(serialize($interval));
var_dump($interval->s, $interval->f);
?>
--EXPECT--
int(1)
float(-1.0E-6)
int(1)
float(-1.0E-6)
2 changes: 1 addition & 1 deletion ext/standard/tests/serialize/bug69425.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ array(2) {
["s"]=>
int(-1)
["f"]=>
float(-1)
float(0)
["weekday"]=>
int(-1)
["weekday_behavior"]=>
Expand Down

0 comments on commit 866adb1

Please sign in to comment.