Skip to content

date: Validate ISO 8601 duration strings for null bytes early - #24357

Merged
TimWolla merged 1 commit into
php:PHP-8.6from
adapik:fix-duration-iso8601-null-byte
Oct 16, 2026
Merged

TimWolla merged 1 commit into
php:PHP-8.6from
adapik:fix-duration-iso8601-null-byte

Conversation

@adapik

@adapik adapik commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

timelib takes a NUL-terminated string, so everything after an embedded NUL byte was silently ignored. Now it throws the same Time\TimeException as for any other malformed string.

// Before: Time\Duration of 5 seconds
// Now: Time\TimeException: The ISO 8601 duration string could not be parsed
Time\Duration::fromIso8601DurationString("PT5S\0garbage");

@TimWolla
TimWolla merged commit 90a271f into php:PHP-8.6 Oct 16, 2026
30 of 34 checks passed
TimWolla added a commit that referenced this pull request Oct 16, 2026
* PHP-8.6:
  date: Validate ISO 8601 duration strings for null bytes early (#24357)
  date: Validate nanoseconds range and reject negative zero duration (#24356)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants