diff --git a/NEWS b/NEWS index f7ce045fb2e..86672aea04a 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 8.4.0 +- Calendar: + . Fixed jdtogregorian overflow. (David Carlier) + - PDO: . Fixed memory leak of `setFetchMode()`. (SakiTakamachi) diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c index dab12e5187d..17dc6db0e63 100644 --- a/ext/calendar/gregor.c +++ b/ext/calendar/gregor.c @@ -148,11 +148,15 @@ void SdnToGregorian( int dayOfYear; if (sdn <= 0 || - sdn > (LONG_MAX - 4 * GREGOR_SDN_OFFSET) / 4) { + sdn > (ZEND_LONG_MAX - 4 * GREGOR_SDN_OFFSET) / 4) { goto fail; } temp = (sdn + GREGOR_SDN_OFFSET) * 4 - 1; + if (temp < 0 || (temp / DAYS_PER_400_YEARS) > INT_MAX) { + goto fail; + } + /* Calculate the century (year/100). */ century = temp / DAYS_PER_400_YEARS; diff --git a/ext/calendar/tests/gh16235.phpt b/ext/calendar/tests/gh16235.phpt new file mode 100644 index 00000000000..6b885620982 --- /dev/null +++ b/ext/calendar/tests/gh16235.phpt @@ -0,0 +1,11 @@ +--TEST-- +GH-16235 (jdtogregorian overflow on argument) +--EXTENSIONS-- +calendar +--FILE-- + +--EXPECT-- +DONE