Skip to content

Throw a ValueError when the parameter includes NUL bytes in strptime #21830

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
LamentXU123 wants to merge 1 commit into from
Closed

Throw a ValueError when the parameter includes NUL bytes in strptime #21830

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,8 @@ PHP NEWS
(Weilin Du)
. getenv() and putenv() now raises a ValueError when the first argument
contains null bytes. (Weilin Du)
. strptime() now raises a ValueError when $timestamp or $format contains
null bytes. (Weilin Du)

- Streams:
. Added so_keepalive, tcp_keepidle, tcp_keepintvl and tcp_keepcnt stream
Expand Down
2 changes: 2 additions & 0 deletions UPGRADING
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,8 @@ PHP 8.6 UPGRADE NOTES
argument value is passed.
. scandir() now raises a ValueError when an invalid $sorting_order
argument value is passed.
. strptime() now raises a ValueError when the $timestamp or $format
argument contains null bytes.

- Zip:
. ZipArchive::extractTo now raises a TypeError for the
Expand Down
4 changes: 2 additions & 2 deletions ext/standard/datetime.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@ PHP_FUNCTION(strptime)
char *unparsed_part;

ZEND_PARSE_PARAMETERS_START(2, 2)
Z_PARAM_STRING(ts, ts_length)
Z_PARAM_STRING(format, format_length)
Z_PARAM_PATH(ts, ts_length)
Z_PARAM_PATH(format, format_length)
ZEND_PARSE_PARAMETERS_END();

memset(&parsed_time, 0, sizeof(parsed_time));
Expand Down
30 changes: 30 additions & 0 deletions ext/standard/tests/time/strptime_null_bytes.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
--TEST--
strptime() rejects null bytes
--SKIPIF--
<?php
if (!function_exists('strptime')) {
die("skip - strptime() function not available in this build");
}
?>
--FILE--
<?php

try {
strptime("2024-01-01\0UTC", "%Y-%m-%d");
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}

try {
strptime("2024-01-01", "%Y-%m-%d\0");
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}

?>
--EXPECTF--
Deprecated: Function strptime() is deprecated since 8.2, use date_parse_from_format() (for locale-independent parsing), or IntlDateFormatter::parse() (for locale-dependent parsing) instead in %s on line %d
Copy link
Copy Markdown
Member

@devnexen devnexen Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure it is worth it in that case because ^

Copy link
Copy Markdown
Contributor Author

@LamentXU123 LamentXU123 Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah me too. Not sure if this should be done in deprecated functions

strptime(): Argument #1 ($timestamp) must not contain any null bytes

Deprecated: Function strptime() is deprecated since 8.2, use date_parse_from_format() (for locale-independent parsing), or IntlDateFormatter::parse() (for locale-dependent parsing) instead in %s on line %d
strptime(): Argument #2 ($format) must not contain any null bytes
Loading