archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix GH-19371: integer overflow in calendar.c
This commit is contained in:
Niels Dossche 2025-08-07 19:09:03 +02:00
commit a3f34043de
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 87 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

25
ext/calendar/calendar.c
View file

@ -197,6 +197,16 @@ PHP_FUNCTION(cal_days_in_month)
RETURN_THROWS(); RETURN_THROWS();
} }
if (UNEXPECTED(month <= 0 || month > INT32_MAX - 1)) {
zend_argument_value_error(2, "must be between 1 and %d", INT32_MAX - 1);
RETURN_THROWS();
}
if (UNEXPECTED(year > INT32_MAX - 1)) {
zend_argument_value_error(3, "must be less than %d", INT32_MAX - 1);
RETURN_THROWS();
}
calendar = &cal_conversion_table[cal]; calendar = &cal_conversion_table[cal];
sdn_start = calendar->to_jd(year, month, 1); sdn_start = calendar->to_jd(year, month, 1);
@ -242,6 +252,21 @@ PHP_FUNCTION(cal_to_jd)
RETURN_THROWS(); RETURN_THROWS();
} }
if (UNEXPECTED(month <= 0 || month > INT32_MAX - 1)) {
zend_argument_value_error(2, "must be between 1 and %d", INT32_MAX - 1);
RETURN_THROWS();
}
if (UNEXPECTED(ZEND_LONG_EXCEEDS_INT(day))) {
zend_argument_value_error(3, "must be between %d and %d", INT32_MIN, INT32_MAX);
RETURN_THROWS();
}
if (UNEXPECTED(year > INT32_MAX - 1)) {
zend_argument_value_error(4, "must be less than %d", INT32_MAX - 1);
RETURN_THROWS();
}
RETURN_LONG(cal_conversion_table[cal].to_jd(year, month, day)); RETURN_LONG(cal_conversion_table[cal].to_jd(year, month, day));
} }
/* }}} */ /* }}} */

2
ext/calendar/tests/cal_days_in_month_error1.phpt
View file

@ -12,7 +12,7 @@ try {
echo "{$ex->getMessage()}\n"; echo "{$ex->getMessage()}\n";
} }
try{ try{
cal_days_in_month(CAL_GREGORIAN,0, 2009); cal_days_in_month(CAL_GREGORIAN,20, 2009);
} catch (ValueError $ex) { } catch (ValueError $ex) {
echo "{$ex->getMessage()}\n"; echo "{$ex->getMessage()}\n";
} }

61
ext/calendar/tests/gh19371.phpt Normal file
View file

@ -0,0 +1,61 @@
--TEST--
GH-19371 (integer overflow in calendar.c)
--SKIPIF--
<?php if (PHP_INT_SIZE !== 8) die("skip only for 64-bit"); ?>
--EXTENSIONS--
calendar
--FILE--
<?php
try {
echo cal_days_in_month(CAL_GREGORIAN, 12, PHP_INT_MAX);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_days_in_month(CAL_GREGORIAN, PHP_INT_MIN, 1);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_days_in_month(CAL_GREGORIAN, PHP_INT_MAX, 1);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_to_jd(CAL_GREGORIAN, PHP_INT_MIN, 1, 1);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_to_jd(CAL_GREGORIAN, PHP_INT_MAX, 1, 1);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_to_jd(CAL_GREGORIAN, 1, PHP_INT_MIN, 1);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_to_jd(CAL_GREGORIAN, 1, PHP_INT_MAX, 1);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
echo cal_to_jd(CAL_GREGORIAN, 1, 1, PHP_INT_MAX);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
cal_days_in_month(): Argument #3 ($year) must be less than 2147483646
cal_days_in_month(): Argument #2 ($month) must be between 1 and 2147483646
cal_days_in_month(): Argument #2 ($month) must be between 1 and 2147483646
cal_to_jd(): Argument #2 ($month) must be between 1 and 2147483646
cal_to_jd(): Argument #2 ($month) must be between 1 and 2147483646
cal_to_jd(): Argument #3 ($day) must be between -2147483648 and 2147483647
cal_to_jd(): Argument #3 ($day) must be between -2147483648 and 2147483647
cal_to_jd(): Argument #4 ($year) must be less than 2147483646