[php-src] master: Merge branch 'PHP-8.5'

Author: Weilin Du (LamentXU123)
Date: 2026-07-07T22:25:03+08:00

Commit: https://github.com/php/php-src/commit/ad48d1ce5c629a5d858019b49b3c47d704b216cb
Raw diff: https://github.com/php/php-src/commit/ad48d1ce5c629a5d858019b49b3c47d704b216cb.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() (#22604)

Changed paths:
  A  ext/calendar/tests/gh22602.phpt
  M  NEWS
  M  ext/calendar/gregor.c
  M  ext/calendar/julian.c


Diff:

diff --git a/NEWS b/NEWS
index 11c9d1db1af8..8971e7d317a3 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
     recurses through zend_call_function, such as a self-attached SPL
     iterator). (iliaal)
 
+- Calendar:
+  . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
+    INT_MAX year). (arshidkv12)
+
 - DBA:
   . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
 
diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c
index 3aef7ae6ac50..eaee9c8c73c7 100644
--- a/ext/calendar/gregor.c
+++ b/ext/calendar/gregor.c
@@ -209,6 +209,7 @@ zend_long GregorianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4714 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);
diff --git a/ext/calendar/julian.c b/ext/calendar/julian.c
index baff0771532e..c24527941d3e 100644
--- a/ext/calendar/julian.c
+++ b/ext/calendar/julian.c
@@ -222,6 +222,7 @@ zend_long JulianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4713 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);
diff --git a/ext/calendar/tests/gh22602.phpt b/ext/calendar/tests/gh22602.phpt
new file mode 100644
index 000000000000..d165a0174094
--- /dev/null
+++ b/ext/calendar/tests/gh22602.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year)
+--EXTENSIONS--
+calendar
+--FILE--
+<?php
+$max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX;
+$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN;
+
+var_dump(gregoriantojd(5, 5, $max));
+var_dump(gregoriantojd(5, 5, $min));
+var_dump(juliantojd(5, 5, 2147483647));
+var_dump(juliantojd(5, 5, -2147483647));
+
+?>
+--EXPECT--
+int(0)
+int(0)
+int(0)
+int(0)