diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c index 3aef7ae6ac50..eaee9c8c73c7 100644 --- a/ext/calendar/gregor.c +++ b/ext/calendar/gregor.c @@ -209,6 +209,7 @@ zend_long GregorianToSdn( /* check for invalid dates */ if (inputYear == 0 || inputYear < -4714 || + inputYear > INT_MAX - 4800 || inputMonth <= 0 || inputMonth > 12 || inputDay <= 0 || inputDay > 31) { return (0); diff --git a/ext/calendar/julian.c b/ext/calendar/julian.c index ac580aa08e06..53a207a606f4 100644 --- a/ext/calendar/julian.c +++ b/ext/calendar/julian.c @@ -222,6 +222,7 @@ zend_long JulianToSdn( /* check for invalid dates */ if (inputYear == 0 || inputYear < -4713 || + inputYear > INT_MAX - 4800 || inputMonth <= 0 || inputMonth > 12 || inputDay <= 0 || inputDay > 31) { return (0); diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt new file mode 100644 index 000000000000..d165a0174094 --- /dev/null +++ b/ext/calendar/tests/gh22602.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year) +--EXTENSIONS-- +calendar +--FILE-- + 2147483647 ? 2147483647 : PHP_INT_MAX; +$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN; + +var_dump(gregoriantojd(5, 5, $max)); +var_dump(gregoriantojd(5, 5, $min)); +var_dump(juliantojd(5, 5, 2147483647)); +var_dump(juliantojd(5, 5, -2147483647)); + +?> +--EXPECT-- +int(0) +int(0) +int(0) +int(0)