From 090a157e466f7f58d42e6e781d852b35f6d6ec7c Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Sun, 5 Jul 2026 15:26:57 +0530 Subject: [PATCH 1/8] ext/calendar: Fix integer overflow in GregorianToSdn() ext/calendar: Fix integer overflow in GregorianToSdn() ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/gregor.c | 2 ++ ext/calendar/tests/gh22602.phpt | 10 ++++++++++ 2 files changed, 12 insertions(+) create mode 100644 ext/calendar/tests/gh22602.phpt diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c index 3aef7ae6ac50..bdf63156d9fb 100644 --- a/ext/calendar/gregor.c +++ b/ext/calendar/gregor.c @@ -209,6 +209,7 @@ zend_long GregorianToSdn( /* check for invalid dates */ if (inputYear == 0 || inputYear < -4714 || + inputYear > INT_MAX - 4800 || inputMonth <= 0 || inputMonth > 12 || inputDay <= 0 || inputDay > 31) { return (0); @@ -222,6 +223,7 @@ zend_long GregorianToSdn( return (0); } } + /* Make year always a positive number. */ if (inputYear < 0) { year = inputYear + 4801; diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt new file mode 100644 index 000000000000..44754bf79700 --- /dev/null +++ b/ext/calendar/tests/gh22602.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug GH-22602: (gregoriantojd() integer overflow with INT_MAX year) +--EXTENSIONS-- +calendar +--FILE-- + 2147483647 ? 2147483647 : PHP_INT_MAX)); +?> +--EXPECTF-- +int(%d) From 0cabaf2d93e477c1aa70b074251ebdd623fcf758 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Sun, 5 Jul 2026 19:47:47 +0530 Subject: [PATCH 2/8] ext/calendar: Fix integer overflow in GregorianToSdn() ext/calendar: Fix integer overflow in GregorianToSdn() ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/gregor.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c index bdf63156d9fb..e43e0e925264 100644 --- a/ext/calendar/gregor.c +++ b/ext/calendar/gregor.c @@ -223,14 +223,13 @@ zend_long GregorianToSdn( return (0); } } - /* Make year always a positive number. */ if (inputYear < 0) { year = inputYear + 4801; } else { year = inputYear + 4800; } - + /* Adjust the start of the year. */ if (inputMonth > 2) { month = inputMonth - 3; From 9ef92f03c922bdd309a1d6f4389bef8d78f562f3 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Sun, 5 Jul 2026 20:00:27 +0530 Subject: [PATCH 3/8] ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/gregor.c | 1 - 1 file changed, 1 deletion(-) diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c index e43e0e925264..fd7c07c14472 100644 --- a/ext/calendar/gregor.c +++ b/ext/calendar/gregor.c @@ -229,7 +229,6 @@ zend_long GregorianToSdn( } else { year = inputYear + 4800; } - /* Adjust the start of the year. */ if (inputMonth > 2) { month = inputMonth - 3; From 6573656a8d05bead047dd4189372b386f87687c7 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Mon, 6 Jul 2026 14:17:31 +0530 Subject: [PATCH 4/8] ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/tests/gh22602.phpt | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt index 44754bf79700..5999889328ef 100644 --- a/ext/calendar/tests/gh22602.phpt +++ b/ext/calendar/tests/gh22602.phpt @@ -4,7 +4,12 @@ Bug GH-22602: (gregoriantojd() integer overflow with INT_MAX year) calendar --FILE-- 2147483647 ? 2147483647 : PHP_INT_MAX)); +$max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX; +$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN; + +var_dump(gregoriantojd(5, 5, $max)); +var_dump(gregoriantojd(5, 5, $min)); ?> ---EXPECTF-- -int(%d) +--EXPECT-- +int(0) +int(0) From e8e9198ae76bff91663a65c1e0842c6117d976c4 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Mon, 6 Jul 2026 17:25:34 +0530 Subject: [PATCH 5/8] ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/julian.c | 1 + ext/calendar/tests/gh22602.phpt | 3 +++ 2 files changed, 4 insertions(+) diff --git a/ext/calendar/julian.c b/ext/calendar/julian.c index ac580aa08e06..53a207a606f4 100644 --- a/ext/calendar/julian.c +++ b/ext/calendar/julian.c @@ -222,6 +222,7 @@ zend_long JulianToSdn( /* check for invalid dates */ if (inputYear == 0 || inputYear < -4713 || + inputYear > INT_MAX - 4800 || inputMonth <= 0 || inputMonth > 12 || inputDay <= 0 || inputDay > 31) { return (0); diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt index 5999889328ef..2d83d9ce56c7 100644 --- a/ext/calendar/tests/gh22602.phpt +++ b/ext/calendar/tests/gh22602.phpt @@ -9,7 +9,10 @@ $min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN; var_dump(gregoriantojd(5, 5, $max)); var_dump(gregoriantojd(5, 5, $min)); +var_dump(juliantojd(5, 5, 2147483647)); + ?> --EXPECT-- int(0) int(0) +int(0) From aff63d138610b66803e1de010db73f89223e8e73 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Mon, 6 Jul 2026 17:26:14 +0530 Subject: [PATCH 6/8] ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/tests/gh22602.phpt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt index 2d83d9ce56c7..37880305ded0 100644 --- a/ext/calendar/tests/gh22602.phpt +++ b/ext/calendar/tests/gh22602.phpt @@ -10,9 +10,11 @@ $min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN; var_dump(gregoriantojd(5, 5, $max)); var_dump(gregoriantojd(5, 5, $min)); var_dump(juliantojd(5, 5, 2147483647)); +var_dump(juliantojd(5, 5, -2147483647)); ?> --EXPECT-- int(0) int(0) int(0) +int(0) From 21a898cf341ab6478bc7be7f9caca9f82b68bc57 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Mon, 6 Jul 2026 18:20:05 +0530 Subject: [PATCH 7/8] ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/julian.c | 1 + ext/calendar/tests/gh22602.phpt | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ext/calendar/julian.c b/ext/calendar/julian.c index 53a207a606f4..05aeb4aef2eb 100644 --- a/ext/calendar/julian.c +++ b/ext/calendar/julian.c @@ -227,6 +227,7 @@ zend_long JulianToSdn( inputDay <= 0 || inputDay > 31) { return (0); } + /* check for dates before SDN 1 (Jan 2, 4713 B.C.) */ if (inputYear == -4713) { if (inputMonth == 1 && inputDay == 1) { diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt index 37880305ded0..d165a0174094 100644 --- a/ext/calendar/tests/gh22602.phpt +++ b/ext/calendar/tests/gh22602.phpt @@ -1,5 +1,5 @@ --TEST-- -Bug GH-22602: (gregoriantojd() integer overflow with INT_MAX year) +Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year) --EXTENSIONS-- calendar --FILE-- From fefe297c6c34ceb403d616ae242c10f6a206cd45 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Mon, 6 Jul 2026 18:21:08 +0530 Subject: [PATCH 8/8] ext/calendar: Fix integer overflow in GregorianToSdn() ext/calendar: Fix integer overflow in GregorianToSdn() ext/calendar: Fix integer overflow in GregorianToSdn() --- ext/calendar/gregor.c | 1 + ext/calendar/julian.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c index fd7c07c14472..eaee9c8c73c7 100644 --- a/ext/calendar/gregor.c +++ b/ext/calendar/gregor.c @@ -229,6 +229,7 @@ zend_long GregorianToSdn( } else { year = inputYear + 4800; } + /* Adjust the start of the year. */ if (inputMonth > 2) { month = inputMonth - 3; diff --git a/ext/calendar/julian.c b/ext/calendar/julian.c index 05aeb4aef2eb..53a207a606f4 100644 --- a/ext/calendar/julian.c +++ b/ext/calendar/julian.c @@ -227,7 +227,6 @@ zend_long JulianToSdn( inputDay <= 0 || inputDay > 31) { return (0); } - /* check for dates before SDN 1 (Jan 2, 4713 B.C.) */ if (inputYear == -4713) { if (inputMonth == 1 && inputDay == 1) {