Merge branch 'PHP-8.6'

* PHP-8.6:
  date: Validate ISO 8601 duration strings for null bytes early (#24357)
  date: Validate nanoseconds range and reject negative zero duration (#24356)

Author: TimWolla

ext/date/tests/time/duration/methods/fromIso8601DurationString.phpt

@@ -34,10 +34,14 @@ $specifications = [
     'P1DT0S',
     '2000-01-01T00:00:00Z',
     '2000-01-01T00:00:00Z/PT1H',
+
+    "PT5S\0garbage",
+    "PT5S\0",
+    "\0PT5S",
 ];
 
 foreach ($specifications as $specification) {
-    printf("%-25s: ", $specification);
+    printf("%-25s: ", addcslashes($specification, "\0"));
 
     try {
         echo f(Time\Duration::fromIso8601DurationString($specification)), PHP_EOL;
@@ -72,3 +76,6 @@ P1M                      : Time\TimeException: The ISO 8601 duration string may
 P1DT0S                   : Time\TimeException: The ISO 8601 duration string may only contain the time (T) aspect
 2000-01-01T00:00:00Z     : Time\TimeException: The ISO 8601 duration string is missing the period (P) aspect
 2000-01-01T00:00:00Z/PT1H: Time\TimeException: The ISO 8601 duration string may only contain the period (P) aspect
+PT5S\000garbage          : Time\TimeException: The ISO 8601 duration string could not be parsed
+PT5S\000                 : Time\TimeException: The ISO 8601 duration string could not be parsed
+\000PT5S                 : Time\TimeException: The ISO 8601 duration string could not be parsed

ext/date/tests/time/duration/serialize.phpt

@@ -46,6 +46,20 @@ try {
     echo $e::class, ': ', $e->getMessage(), PHP_EOL;
 }
 
+try {
+    // Nanoseconds that would be truncated to a valid value by a 32-bit conversion (2^32 + 5).
+    unserialize('O:13:"Time\Duration":3:{s:7:"seconds";i:1;s:11:"nanoseconds";i:4294967301;s:8:"negative";b:0;}');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+}
+
+try {
+    // A negative zero duration is rejected.
+    unserialize('O:13:"Time\Duration":3:{s:7:"seconds";i:0;s:11:"nanoseconds";i:0;s:8:"negative";b:1;}');
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), PHP_EOL;
+}
+
 try {
     Time\Duration::fromSeconds(1, 1)
         ->__unserialize([
@@ -69,3 +83,5 @@ Exception: Invalid serialization data for Time\Duration object
 Exception: Invalid serialization data for Time\Duration object
 Exception: Invalid serialization data for Time\Duration object
 Exception: Invalid serialization data for Time\Duration object
+Exception: Invalid serialization data for Time\Duration object
+Exception: Invalid serialization data for Time\Duration object

ext/date/time_duration.c

@@ -175,11 +175,18 @@ PHP_METHOD(Time_Duration, __unserialize)
 		goto fail;
 	}
 
-	/* Verify that both properties are positive, since the timelib_duration_ctor_static() takes unsigned. */
+	/* Verify that both properties are non-negative, since the timelib_duration_ctor_static() takes
+	 * unsigned. */
 	if (Z_LVAL_P(seconds) < 0 || Z_LVAL_P(nanoseconds) < 0) {
 		goto fail;
 	}
 
+	/* timelib_duration_ctor_static() takes a uint32_t for nanoseconds, so larger values would
+	 * implicitly wrap around instead of being rejected. */
+	if (Z_LVAL_P(nanoseconds) >= NANOS_IN_SEC) {
+		goto fail;
+	}
+
 	int error = timelib_duration_ctor_static(&duration->duration, Z_LVAL_P(seconds), Z_LVAL_P(nanoseconds), Z_TYPE_P(negative) == IS_TRUE);
 	if (error != TIMELIB_ERROR_NO_ERROR) {
 		throw_timelib_error(error);
@@ -191,6 +198,10 @@ PHP_METHOD(Time_Duration, __unserialize)
 		goto fail;
 	}
 
+	if ((Z_TYPE_P(negative) == IS_TRUE) != duration->duration.negative) {
+		goto fail;
+	}
+
 	return;
 
  fail:
@@ -315,6 +326,11 @@ PHP_METHOD(Time_Duration, fromIso8601DurationString)
 		Z_PARAM_STR(specification);
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (zend_str_has_nul_byte(specification)) {
+		throw_timelib_error(TIMELIB_ERROR_ISO8601_DURATION_PARSE_FAILURE);
+		RETURN_THROWS();
+	}
+
 	int error;
 	timelib_duration *d = timelib_duration_create_from_iso8601string(ZSTR_VAL(specification), &error);
 	if (error != TIMELIB_ERROR_NO_ERROR) {