Fixed Bug #62500 (Segfault in DateInterval class when extended)

Author: laruence

NEWS

@@ -10,6 +10,9 @@ PHP                                                                        NEWS
   . Fixed bug #62499 (curl_setopt($ch, CURLOPT_COOKIEFILE, "") returns false).
     ([email protected], Laruence)
 
+- DateTime:
+  . Fixed Bug #62500 (Segfault in DateInterval class when extended). (Laruence)
+
 14 Jun 2012, PHP 5.3.14
 
 - CLI SAPI:

ext/date/php_date.c

@@ -3511,6 +3511,14 @@ zval *date_interval_read_property(zval *object, zval *member, int type TSRMLS_DC
 
 	obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+	if (!obj->initialized) {
+		retval = (zend_get_std_object_handlers())->read_property(object, member, type TSRMLS_CC);
+		if (member == &tmp_member) {
+			zval_dtor(member);
+		}
+		return retval;
+	}
+
 #define GET_VALUE_FROM_STRUCT(n,m)            \
 	if (strcmp(Z_STRVAL_P(member), m) == 0) { \
 		value = obj->diff->n;                 \
@@ -3560,8 +3568,17 @@ void date_interval_write_property(zval *object, zval *member, zval *value TSRMLS
 		convert_to_string(&tmp_member);
 		member = &tmp_member;
 	}
+
 	obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+	if (!obj->initialized) {
+		(zend_get_std_object_handlers())->write_property(object, member, value TSRMLS_CC);
+		if (member == &tmp_member) {
+			zval_dtor(member);
+		}
+		return;
+	}
+
 #define SET_VALUE_FROM_STRUCT(n,m)            \
 	if (strcmp(Z_STRVAL_P(member), m) == 0) { \
 		if (value->type != IS_LONG) {         \

ext/date/tests/bug62500.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #62500 (Segfault in DateInterval class when extended)
+--INI--
+date.timezone=GMT
+--FILE--
+<?php
+class Crasher extends DateInterval {
+    public $foo;
+    public function __construct($time_spec) {
+        var_dump($this->foo);
+        $this->foo = 3;
+        var_dump($this->foo);
+        var_dump($this->{2});
+        parent::__construct($time_spec);
+    }
+}
+try {
+    $c = new Crasher('blah');
+} catch (Exception $e) {
+    var_dump($e->getMessage());
+}
+--EXPECTF--
+NULL
+int(3)
+
+Notice: Undefined property: Crasher::$2 in %sbug62500.php on line %d
+NULL
+string(%s) "DateInterval::__construct(): Unknown or bad format (blah)"