bug72963.phpt 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192
  1. --TEST--
  2. Bug #72963 (Null-byte injection in CreateFromFormat and related functions)
  3. --INI--
  4. date.timezone=UTC
  5. --FILE--
  6. <?php
  7. $strings = [
  8. '8/8/2016',
  9. "8/8/2016\0asf",
  10. ];
  11. foreach ($strings as $string) {
  12. $d1 = $d2 = $d3 = NULL;
  13. echo "\nCovering string: ", addslashes($string), "\n\n";
  14. try {
  15. $d1 = DateTime::createFromFormat('!m/d/Y', $string);
  16. } catch (ValueError $v) {
  17. echo $v->getMessage(), "\n";
  18. }
  19. try {
  20. $d2 = DateTimeImmutable::createFromFormat('!m/d/Y', $string);
  21. } catch (ValueError $v) {
  22. echo $v->getMessage(), "\n";
  23. }
  24. try {
  25. $d3 = date_parse_from_format('m/d/Y', $string);
  26. } catch (ValueError $v) {
  27. echo $v->getMessage(), "\n";
  28. }
  29. var_dump($d1, $d2, $d3);
  30. }
  31. ?>
  32. --EXPECT--
  33. Covering string: 8/8/2016
  34. object(DateTime)#1 (3) {
  35. ["date"]=>
  36. string(26) "2016-08-08 00:00:00.000000"
  37. ["timezone_type"]=>
  38. int(3)
  39. ["timezone"]=>
  40. string(3) "UTC"
  41. }
  42. object(DateTimeImmutable)#2 (3) {
  43. ["date"]=>
  44. string(26) "2016-08-08 00:00:00.000000"
  45. ["timezone_type"]=>
  46. int(3)
  47. ["timezone"]=>
  48. string(3) "UTC"
  49. }
  50. array(12) {
  51. ["year"]=>
  52. int(2016)
  53. ["month"]=>
  54. int(8)
  55. ["day"]=>
  56. int(8)
  57. ["hour"]=>
  58. bool(false)
  59. ["minute"]=>
  60. bool(false)
  61. ["second"]=>
  62. bool(false)
  63. ["fraction"]=>
  64. bool(false)
  65. ["warning_count"]=>
  66. int(0)
  67. ["warnings"]=>
  68. array(0) {
  69. }
  70. ["error_count"]=>
  71. int(0)
  72. ["errors"]=>
  73. array(0) {
  74. }
  75. ["is_localtime"]=>
  76. bool(false)
  77. }
  78. Covering string: 8/8/2016\0asf
  79. DateTime::createFromFormat(): Argument #2 ($datetime) must not contain any null bytes
  80. DateTimeImmutable::createFromFormat(): Argument #2 ($datetime) must not contain any null bytes
  81. date_parse_from_format(): Argument #2 ($datetime) must not contain any null bytes
  82. NULL
  83. NULL
  84. NULL