Repository navigation
DatePeriod::__set_state() cannot handle null start #20936
Description
Description
The following code:
<?php
$v_973 = '2022-07-16 12:00:00';
$v_974 = 'UTC';
$v_975 = new DateTimeZone($v_974,);
$v_976 = new DateTime($v_973,$v_975,);
$v_978 = null;
$v_980 = 'P2D';
$v_981 = new DateInterval($v_980,);
$v_983 = 2;
$v_985 = False;
$v_987 = True;
$v_966 = array('start' => $v_988,'end' => $v_976,'current' => $v_978,'interval' => $v_981,'recurrences' => $v_983,'include_start_date' => $v_985,'include_end_date' => $v_987,);
$v_988 = DatePeriod::__set_state($v_966,);
$v_989 = var_dump($v_988,);Resulted in this output:
/home/w023dtc/nightly_php/php-src/Zend/zend_API.c:1794:6: runtime error: member access within null pointer of type 'zend_class_entry' (aka 'struct _zend_class_entry')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/Zend/zend_API.c:1794
PHP Version
nightly
Operating System
ubuntu 22.04
Activity
[-]undefined behavior in zend_API.c[/-][+]DatePeriod::__set_state() cannot handle null start[/+]Fix phpGH-20936: DatePeriod::__set_state() cannot handle null start
chongwick commentedon Jan 15, 2026
@ndossche just wondering, but how do you feel about ai coding tools? Given a bug report like this, do you think it could diagnose/fix the root cause?
ndossche commentedon Jan 15, 2026
I feel like the actual understanding of existig code of these tools is rather poor, and they more so try to target the symptom rather than the root cause. From the AI PRs or reports I've seen on this repo, almost none of them were right
chongwick commentedon Jan 15, 2026
I'm either terrible at using coding assistants or if I'm being gaslit... This fuzzer is basically a PHP interpreter with a custom IR. I tried seeing what claude code could do with it, but it kept hallucinating AST node types/properties.
ndossche commentedon Jan 15, 2026
Sounds familiar.
Is your fuzzer public btw? I do see https://github.com/chongwick/xphuzz .
I suppose you're working on a research paper?
chongwick commentedon Jan 15, 2026
yes, my dissertation is on interpreter fuzzing.
xphuzz is an LLM-based fuzzer. kinda fun. kinda tricky. kinda expensive to run.
I call the ir-based one phuzzilli. I'd be happy to open-source it if you guys like.
chongwick commentedon Jan 15, 2026
Is there a message board where I can mention this tool? The design is pretty interesting
ndossche commentedon Jan 17, 2026
I'd be interested in reading about it. I do SAST research myself as my day job.
I suppose, if it's on-topic enough for PHP, you can post about it on the internals mailing list (https://www.php.net/mailing-lists.php). That's what happened with FlowFusion which also came from a PhD student who developed a fuzzing tool.
chongwick commentedon Jan 17, 2026
Thank you.
I figured as much about your background. I was actually having a discussion about your ESSS tool, recently.
My coauthors want to wait to open source the tool until after the paper is (hopefully) accepted. That'll give me some time to clean up the code.
ndossche commentedon Jan 17, 2026
Understandably so, best of luck in any case. I'm intrigued
Merge branch 'PHP-8.4' into PHP-8.5
Merge branch 'PHP-8.5'
Fix GH-20936: DatePeriod::__set_state() cannot handle null start