Fixed bug #78139 (timezone_open accepts invalid timezone string argument).

NEWS

@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 
 - Date:
   . Fixed bug #74671 (DST timezone abbreviation has incorrect offset). (Derick)
+  . Fixed bug #78139 (timezone_open accepts invalid timezone string argument).
+    (Derick)
 
 09 Jun 2022, PHP 8.0.20
 

ext/date/php_date.c

@@ -3428,6 +3428,12 @@ static int timezone_initialize(php_timezone_obj *tzobj, const char *tz, size_t t
 
 	dummy_t->z = timelib_parse_zone(&tz, &dst, dummy_t, &not_found, DATE_TIMEZONEDB, php_date_parse_tzfile_wrapper);
 	dummy_t->dst = dst;
+	if (!not_found && (*tz != '\0')) {
+		php_error_docref(NULL, E_WARNING, "Unknown or bad timezone (%s)", orig_tz);
+		timelib_free(dummy_t->tz_abbr);
+		efree(dummy_t);
+		return FAILURE;
+	}
 	if (not_found) {
 		php_error_docref(NULL, E_WARNING, "Unknown or bad timezone (%s)", orig_tz);
 		efree(dummy_t);

ext/date/tests/bug78139.phpt

@@ -0,0 +1,73 @@
+--TEST--
+Bug #78139 (timezone_open accepts invalid timezone string argument)
+--FILE--
+<?php
+$strings = [
+	"x",
+	"x UTC",
+	"xx UTC",
+	"xUTC",
+	"UTCx",
+	"UTC xx",
+];
+
+foreach ($strings as $string)
+{
+	echo "Parsing '{$string}':\n";
+
+	$tz = timezone_open($string);
+	var_dump($tz);
+
+	try {
+		$tz = new \DateTimeZone($string);
+	} catch (Exception $e) {
+		echo $e->getMessage(), "\n";
+	}
+
+	echo "\n\n";
+}
+?>
+--EXPECTF--
+Parsing 'x':
+object(DateTimeZone)#1 (2) {
+  ["timezone_type"]=>
+  int(2)
+  ["timezone"]=>
+  string(1) "X"
+}
+
+
+Parsing 'x UTC':
+
+Warning: timezone_open(): Unknown or bad timezone (x UTC) in %sbug78139.php on line %d
+bool(false)
+DateTimeZone::__construct(): Unknown or bad timezone (x UTC)
+
+
+Parsing 'xx UTC':
+
+Warning: timezone_open(): Unknown or bad timezone (xx UTC) in %sbug78139.php on line %d
+bool(false)
+DateTimeZone::__construct(): Unknown or bad timezone (xx UTC)
+
+
+Parsing 'xUTC':
+
+Warning: timezone_open(): Unknown or bad timezone (xUTC) in %sbug78139.php on line %d
+bool(false)
+DateTimeZone::__construct(): Unknown or bad timezone (xUTC)
+
+
+Parsing 'UTCx':
+
+Warning: timezone_open(): Unknown or bad timezone (UTCx) in %sbug78139.php on line %d
+bool(false)
+DateTimeZone::__construct(): Unknown or bad timezone (UTCx)
+
+
+Parsing 'UTC xx':
+
+Warning: timezone_open(): Unknown or bad timezone (UTC xx) in %sbug78139.php on line %d
+bool(false)
+DateTimeZone::__construct(): Unknown or bad timezone (UTC xx)
+