ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() (php#22604)

php#22603

GregorianToSdn() accepted large positive years up to INT_MAX and then added
4800 before doing the SDN calculation, which triggered signed integer
overflow.  JulianToSdn() used the same adjustment and had the same overflow
surface.

Reject years that cannot be adjusted safely before the calculation.  Add
coverage for the reported gregoriantojd() case and the matching juliantojd()
case with boundary values.

Closes php#22602
Closes php#22604

Author: arshidkv12

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.24
 
+- Calendar:
+  . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
+    INT_MAX year). (arshidkv12)
+
 - DBA:
   . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
 

ext/calendar/gregor.c

@@ -209,6 +209,7 @@ zend_long GregorianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4714 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);

ext/calendar/julian.c

@@ -222,6 +222,7 @@ zend_long JulianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4713 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);

ext/calendar/tests/gh22602.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year)
+--EXTENSIONS--
+calendar
+--FILE--
+<?php
+$max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX;
+$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN;
+
+var_dump(gregoriantojd(5, 5, $max));
+var_dump(gregoriantojd(5, 5, $min));
+var_dump(juliantojd(5, 5, 2147483647));
+var_dump(juliantojd(5, 5, -2147483647));
+
+?>
+--EXPECT--
+int(0)
+int(0)
+int(0)
+int(0)