mirror of
https://github.com/php/php-src.git
synced 2026-10-28 09:46:46 +08:00
Louis-Arnaud
89687719b4
GregorianToSdn(), JulianToSdn(), JewishToSdn() and FrenchToSdn() took C int parameters while every PHP_FUNCTION() calling them parses zend_long, so the arguments were implicitly narrowed before any range check ran. Values whose low 32 bits alias into the accepted range slipped past the guards inside the helpers: gregoriantojd(1 + 2**32, 1, 1) returned the Julian Day of month 1 instead of 0. cal_to_jd() and cal_days_in_month() were affected the same way through cal_to_jd_func_t. Widen the parameters so the existing guards see the value the user passed. The typedef's parameter names were also in the wrong order and are fixed to match the callees. JewishToSdn() passes its year on to FindStartOfYear(), whose first two outputs are int, so the year is narrowed once in JewishToSdn() itself, right after the check that leaves both year and year + 1 within int range. FindStartOfYear() keeps its int parameter and stays unaware of bounds its caller enforces. Widening JewishToSdn() additionally removes a signed overflow: `sdn = tishri1 + day - 1` was computed in int, so year 5879542 returned a negative Julian Day. juliantojd_overflow.phpt asserted the aliased result for year 6000000000, which is past the supported maximum enforced since GH-22602 (INT_MAX - 4800); it now returns 0, and the test covers the largest accepted year instead.