diff --git a/ext/date/php_date.c b/ext/date/php_date.c index 527894d2236e0..87b9a61e48d05 100644 --- a/ext/date/php_date.c +++ b/ext/date/php_date.c @@ -3511,6 +3511,11 @@ zval *date_interval_read_property(zval *object, zval *member, int type TSRMLS_DC obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC); + if (!obj->initialized) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "The DateInterval object has not been correctly initialized by its constructor"); + return EG(uninitialized_zval_ptr); + } + #define GET_VALUE_FROM_STRUCT(n,m) \ if (strcmp(Z_STRVAL_P(member), m) == 0) { \ value = obj->diff->n; \ @@ -3562,6 +3567,12 @@ void date_interval_write_property(zval *object, zval *member, zval *value TSRMLS } obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC); + + if (!obj->initialized) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "The DateInterval object has not been correctly initialized by its constructor"); + return; + } + #define SET_VALUE_FROM_STRUCT(n,m) \ if (strcmp(Z_STRVAL_P(member), m) == 0) { \ if (value->type != IS_LONG) { \ diff --git a/ext/date/tests/bug62500.phpt b/ext/date/tests/bug62500.phpt new file mode 100644 index 0000000000000..42484561565ca --- /dev/null +++ b/ext/date/tests/bug62500.phpt @@ -0,0 +1,44 @@ +--TEST-- +Bug #62500 (Segfault in DateInterval class when extended) +--FILE-- +y); + $this->y = 3; + var_dump($this->y); + parent::__construct($time_spec); + } +} + +$c = new DateCrasher('P2Y4DT6H8M'); +var_dump($c); +?> +==DONE== +--EXPECTF-- +Warning: DateCrasher::__construct(): The DateInterval object has not been correctly initialized by its constructor in %s on line %d +NULL + +Warning: DateCrasher::__construct(): The DateInterval object has not been correctly initialized by its constructor in %s on line %d + +Warning: DateCrasher::__construct(): The DateInterval object has not been correctly initialized by its constructor in %s on line %d +NULL +object(DateCrasher)#1 (%d) { + ["y"]=> + int(2) + ["m"]=> + int(0) + ["d"]=> + int(4) + ["h"]=> + int(6) + ["i"]=> + int(8) + ["s"]=> + int(0) + ["invert"]=> + int(0) + ["days"]=> + bool(false) +} +==DONE== \ No newline at end of file