File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -8,6 +8,10 @@ PHP NEWS
88 . Fixed bug GH-22206 (missing return in global register detection).
99 (P3p111n0)
1010
11+ - Calendar:
12+ . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
13+ INT_MAX year). (arshidkv12)
14+
1115- DBA:
1216 . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
1317
Original file line number Diff line number Diff line change @@ -209,6 +209,7 @@ zend_long GregorianToSdn(
209209
210210 /* check for invalid dates */
211211 if (inputYear == 0 || inputYear < -4714 ||
212+ inputYear > INT_MAX - 4800 ||
212213 inputMonth <= 0 || inputMonth > 12 ||
213214 inputDay <= 0 || inputDay > 31 ) {
214215 return (0 );
Original file line number Diff line number Diff line change @@ -222,6 +222,7 @@ zend_long JulianToSdn(
222222
223223 /* check for invalid dates */
224224 if (inputYear == 0 || inputYear < -4713 ||
225+ inputYear > INT_MAX - 4800 ||
225226 inputMonth <= 0 || inputMonth > 12 ||
226227 inputDay <= 0 || inputDay > 31 ) {
227228 return (0 );
Original file line number Diff line number Diff line change 1+ --TEST--
2+ Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year)
3+ --EXTENSIONS--
4+ calendar
5+ --FILE--
6+ <?php
7+ $ max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX ;
8+ $ min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN ;
9+
10+ var_dump (gregoriantojd (5 , 5 , $ max ));
11+ var_dump (gregoriantojd (5 , 5 , $ min ));
12+ var_dump (juliantojd (5 , 5 , 2147483647 ));
13+ var_dump (juliantojd (5 , 5 , -2147483647 ));
14+
15+ ?>
16+ --EXPECT--
17+ int(0)
18+ int(0)
19+ int(0)
20+ int(0)
You can’t perform that action at this time.
0 commit comments