Fixed bug GH-21616: DateTime::modify() wrong across DST boundary

do_adjust_relative() adds h/i/s to wall-clock fields before converting
to a Unix timestamp. Near a spring-forward gap that produces a
nonexistent time, which resolves to the wrong offset.

Fix: zero out relative h/i/s/us before timelib_update_ts(), apply them
to sse directly. Same technique as timelib_add_wall(). y/m/d, weekday
relatives, and first_last_day_of still go through timelib_update_ts.

Also fixes GH-15880.

Author: MarcusXavierr

ext/date/php_date.c

@@ -3288,6 +3288,7 @@ static bool php_date_modify(zval *object, char *modify, size_t modify_len) /* {{
 	php_date_obj *dateobj;
 	timelib_time *tmp_time;
 	timelib_error_container *err = NULL;
+	timelib_sll		 rel_h, rel_i, rel_s, rel_us;
 
 	dateobj = Z_PHPDATE_P(object);
 
@@ -3356,8 +3357,51 @@ static bool php_date_modify(zval *object, char *modify, size_t modify_len) /* {{
 
 	timelib_time_dtor(tmp_time);
 
+	/* Strip relative h/i/s/us before timelib_update_ts() so that
+	 * do_adjust_relative() does not add them to wall-clock fields.
+	 * Wall-clock addition breaks at DST boundaries; SSE arithmetic
+	 * (applied below) is always correct. */
+	rel_h  = dateobj->time->relative.h;
+	rel_i  = dateobj->time->relative.i;
+	rel_s  = dateobj->time->relative.s;
+	rel_us = dateobj->time->relative.us;
+	dateobj->time->relative.h  = 0;
+	dateobj->time->relative.i  = 0;
+	dateobj->time->relative.s  = 0;
+	dateobj->time->relative.us = 0;
+
 	timelib_update_ts(dateobj->time, NULL);
 	timelib_update_from_sse(dateobj->time);
+
+	/* Fold microsecond overflow into seconds so that the seconds
+	 * component goes through SSE arithmetic, not wall-clock.
+	 * Matches timelib_add_wall()'s do_range_limit() call
+	 * (interval.c:317). */
+	if (rel_us >= 1000000 || rel_us <= -1000000) {
+		rel_s  += rel_us / 1000000;
+		rel_us  = rel_us % 1000000;
+	}
+
+	/* Apply h/i/s via SSE (Unix timestamp) arithmetic, matching
+	 * the approach in timelib_add_wall() (interval.c:312). */
+	if (rel_h || rel_i || rel_s) {
+		dateobj->time->sse +=
+			timelib_hms_to_seconds(rel_h, rel_i, rel_s);
+		timelib_update_from_sse(dateobj->time);
+	}
+
+	/* Apply remaining sub-second microseconds. After the above
+	 * normalization rel_us is in (-1000000, 1000000), so the
+	 * cascade into seconds is at most +/-1s -- safe to go through
+	 * wall-clock normalize + update_ts (have_relative is already
+	 * cleared by the first timelib_update_ts call). */
+	if (rel_us) {
+		dateobj->time->us += rel_us;
+		timelib_do_normalize(dateobj->time);
+		timelib_update_ts(dateobj->time, NULL);
+		timelib_update_from_sse(dateobj->time);
+	}
+
 	dateobj->time->have_relative = 0;
 	memset(&dateobj->time->relative, 0, sizeof(dateobj->time->relative));
 

ext/date/tests/date_modify-1.phpt

@@ -25,4 +25,4 @@ Sun, 22 Aug 1993 00:00:00 +12
 Sun, 27 Mar 2005 01:59:59 CET
 Sun, 27 Mar 2005 03:00:00 CEST
 Sun, 30 Oct 2005 01:59:59 CEST
-Sun, 30 Oct 2005 03:00:00 CET
+Sun, 30 Oct 2005 02:00:00 CET