Skip to content

ext/date: Fix strtotime() handling of embedded NUL bytes - #25153

Open
arshidkv12 wants to merge 2 commits into
php:masterfrom
arshidkv12:date-null-check
Open

arshidkv12 wants to merge 2 commits into
php:masterfrom
arshidkv12:date-null-check

Conversation

@arshidkv12

Copy link
Copy Markdown
Contributor

Related to #25150

$a = strtotime("\x00");

var_dump($a);

Current output:

int(1793627532)

Expected output:

bool(false)

strtotime() should return false when the input contains a NUL byte.

@iliaal iliaal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't specific to strtotime(). timelib's scanner skips \0 like a newline, so new DateTime("\0"), modify() and date_parse() accept it as "now" too, and "2026-11-02\0 +1 year" parses fully. A check here only makes strtotime() disagree with the rest of ext/date. The fix belongs in timelib (derickr/timelib, v2022 branch): either treat NUL like whitespace in the empty-string trim in timelib_strtotime(), or report it as an unexpected character so every entry point fails the same way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants