Skip to content

Commit f0f26c7

Browse files
committed
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4: ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() (php#22604)
2 parents 3cf46eb + 12c1f1c commit f0f26c7

4 files changed

Lines changed: 26 additions & 0 deletions

File tree

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ PHP NEWS
88
. Fixed bug GH-22206 (missing return in global register detection).
99
(P3p111n0)
1010

11+
- Calendar:
12+
. Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
13+
INT_MAX year). (arshidkv12)
14+
1115
- DBA:
1216
. Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
1317

ext/calendar/gregor.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ zend_long GregorianToSdn(
209209

210210
/* check for invalid dates */
211211
if (inputYear == 0 || inputYear < -4714 ||
212+
inputYear > INT_MAX - 4800 ||
212213
inputMonth <= 0 || inputMonth > 12 ||
213214
inputDay <= 0 || inputDay > 31) {
214215
return (0);

ext/calendar/julian.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,7 @@ zend_long JulianToSdn(
222222

223223
/* check for invalid dates */
224224
if (inputYear == 0 || inputYear < -4713 ||
225+
inputYear > INT_MAX - 4800 ||
225226
inputMonth <= 0 || inputMonth > 12 ||
226227
inputDay <= 0 || inputDay > 31) {
227228
return (0);

ext/calendar/tests/gh22602.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year)
3+
--EXTENSIONS--
4+
calendar
5+
--FILE--
6+
<?php
7+
$max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX;
8+
$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN;
9+
10+
var_dump(gregoriantojd(5, 5, $max));
11+
var_dump(gregoriantojd(5, 5, $min));
12+
var_dump(juliantojd(5, 5, 2147483647));
13+
var_dump(juliantojd(5, 5, -2147483647));
14+
15+
?>
16+
--EXPECT--
17+
int(0)
18+
int(0)
19+
int(0)
20+
int(0)

0 commit comments

Comments
 (0)