Fix GH-11416: Crash with DatePeriod when uninitialised objects are passed in

Author: derickr

NEWS

@@ -11,6 +11,10 @@ PHP                                                                        NEWS
 - Core:
   . Fixed strerror_r detection at configuration time. (Kévin Dunglas)
 
+- Date:
+  . Fixed bug GH-11416: Crash with DatePeriod when uninitialised objects
+    are passed in. (Derick)
+
 - DOM:
   . Fix DOMEntity field getter bugs. (nielsdos)
   . Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS.

ext/date/php_date.c

@@ -4338,6 +4338,12 @@ PHP_METHOD(DatePeriod, __construct)
 		}
 		dpobj->start_ce = date_ce_date;
 	} else {
+		/* check initialisation */
+		DATE_CHECK_INITIALIZED(Z_PHPDATE_P(start)->time, DateTimeInterface);
+		if (end) {
+			DATE_CHECK_INITIALIZED(Z_PHPDATE_P(end)->time, DateTimeInterface);
+		}
+
 		/* init */
 		php_interval_obj *intobj = Z_PHPINTERVAL_P(interval);
 

ext/date/tests/bug-gh11416.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug GH-11416: Crash with DatePeriod when uninitialised objects are passed in
+--INI--
+date.timezone=UTC
+--FILE--
+<?php
+$now = new DateTimeImmutable();
+
+$date = (new ReflectionClass(DateTime::class))->newInstanceWithoutConstructor();
+try {
+	new DatePeriod($date, new DateInterval('P1D'), 2);
+} catch (Error $e) {
+	echo get_class($e), ': ', $e->getMessage(), "\n";
+}
+
+$date = (new ReflectionClass(DateTime::class))->newInstanceWithoutConstructor();
+try {
+	new DatePeriod($now, new DateInterval('P1D'), $date);
+} catch (Error $e) {
+	echo get_class($e), ': ', $e->getMessage(), "\n";
+}
+
+echo "OK\n";
+?>
+--EXPECT--
+Error: The DateTimeInterface object has not been correctly initialized by its constructor
+Error: The DateTimeInterface object has not been correctly initialized by its constructor
+OK