[php-src] PHP-8.5: ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() (#22604)

Author: arshidkv12 (arshidkv12)
Committer: Weilin Du (LamentXU123)
Date: 2026-07-07T22:23:58+08:00

Commit: https://github.com/php/php-src/commit/12c1f1c12f369a06259d239644cd0d3ce37dbe96
Raw diff: https://github.com/php/php-src/commit/12c1f1c12f369a06259d239644cd0d3ce37dbe96.diff

ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() (#22604)

https://github.com/php/php-src/pull/22603

GregorianToSdn() accepted large positive years up to INT_MAX and then added
4800 before doing the SDN calculation, which triggered signed integer
overflow.  JulianToSdn() used the same adjustment and had the same overflow
surface.

Reject years that cannot be adjusted safely before the calculation.  Add
coverage for the reported gregoriantojd() case and the matching juliantojd()
case with boundary values.

Closes #22602
Closes #22604

Changed paths:
  A  ext/calendar/tests/gh22602.phpt
  M  NEWS
  M  ext/calendar/gregor.c
  M  ext/calendar/julian.c


Diff:

diff --git a/NEWS b/NEWS
index 41fc6d053bc2..5f615701b4ab 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.24
 
+- Calendar:
+  . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
+    INT_MAX year). (arshidkv12)
+
 - DBA:
   . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
 
diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c
index 3aef7ae6ac50..eaee9c8c73c7 100644
--- a/ext/calendar/gregor.c
+++ b/ext/calendar/gregor.c
@@ -209,6 +209,7 @@ zend_long GregorianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4714 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);
diff --git a/ext/calendar/julian.c b/ext/calendar/julian.c
index ac580aa08e06..53a207a606f4 100644
--- a/ext/calendar/julian.c
+++ b/ext/calendar/julian.c
@@ -222,6 +222,7 @@ zend_long JulianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4713 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);
diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt
new file mode 100644
index 000000000000..d165a0174094
--- /dev/null
+++ b/ext/calendar/tests/gh22602.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year)
+--EXTENSIONS--
+calendar
+--FILE--
+<?php
+$max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX;
+$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN;
+
+var_dump(gregoriantojd(5, 5, $max));
+var_dump(gregoriantojd(5, 5, $min));
+var_dump(juliantojd(5, 5, 2147483647));
+var_dump(juliantojd(5, 5, -2147483647));
+
+?>
+--EXPECT--
+int(0)
+int(0)
+int(0)
+int(0)