Changing the properties of a DateInterval through dynamic properties triggers a SegFault #18304
Description
Description
The following code:
<?php
$di = new \DateInterval('P0Y');
$field = 'd';
$i = 1;
$di->$field += $i;
var_dump($di);Resulted in this output:
Process finished with exit code 139 (interrupted by signal 11:SIGSEGV)
But I expected this output instead:
object(DateInterval)#1 (10) {
["y"]=>
int(0)
["m"]=>
int(0)
["d"]=>
int(1)
["h"]=>
int(0)
["i"]=>
int(0)
["s"]=>
int(0)
["f"]=>
float(0)
["invert"]=>
int(0)
["days"]=>
bool(false)
["from_string"]=>
bool(false)
}
3v4l Link: https://3v4l.org/plDlt#v8.3.20
8.3.19 doesn't exhibit this issue, and nor does 8.4.6 and 8.2.28.
Swapping the variable variable for a switch doesn't trigger the same issue.
PHP Version
PHP 8.3.20 (cli) (built: Apr 10 2025 21:33:50) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.20, Copyright (c) Zend Technologies
with Zend OPcache v8.3.20, Copyright (c), by Zend Technologies
with Xdebug v3.4.2, Copyright (c) 2002-2025, by Derick Rethans
Operating System
Ubuntu 24.04.2
Activity
27pchrisl commentedon Apr 11, 2025
My backtrace pointed to
date_interval_get_property_ptr_ptr, git bisecting for the error narrowed it down to ce8ab5f - problem in ce8ab5f#diff-975ac482adc74b487c6ac9d8dde32153e4b8a803ef8ec41e8d6594f0a042db69R4402 ?Removing that line clears the error, but I don't know enough about the change to submit a fix - @nielsdos ?
ndossche commentedon Apr 11, 2025
@27pchrisl Just removing that line will reintroduce the bug that it was trying to solve. It's just missing the NULL check on
cache_slot, as there is no cache slot for a dynamic access. I'll fix it up.I'm surprised there was no test for this though.
Fix phpGH-18304: Changing the properties of a DateInterval through dy…
Fix GH-18304: Changing the properties of a DateInterval through dynam…
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4'