Fixed bug #36644 (possible crash in variant_date_from_timestamp()).

diff --git a/NEWS b/NEWS
index 0680466dd07c10b7daf772e0d4601eb988ed8a1e..3c930dc56e98d022ee528b388e3d5b13214581d4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -75,6 +75,7 @@ PHP                                                                        NEWS
 - Fixed bug #38456 (Apache2 segfaults when virtual() is called in .php
   ErrorDocument). (Ilia)
 - Fixed bug #36975 (natcasesort() causes array_pop() to misbehave). (Hannes)
+- Fixed bug #36644 (possible crash in variant_date_from_timestamp()). (Ilia)
 - Fixed bug #33282 (Re-assignment by reference does not clear the is_ref flag)
   (Ilia,Dmitry, Matt Wilmas)
 

diff --git a/ext/com_dotnet/com_variant.c b/ext/com_dotnet/com_variant.c
index ae350fe1d87602f0d3ecd074ca5271d2056fce78..d45c094a709ec3a30612794c06b278466a57cac0 100644 (file)
--- a/ext/com_dotnet/com_variant.c
+++ b/ext/com_dotnet/com_variant.c
@@ -798,6 +798,11 @@ PHP_FUNCTION(variant_date_from_timestamp)
                return;
        }
 
+       if (timestamp < 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Timestamp value must be a positive value.");
+               RETURN_FALSE;
+       }
+
        VariantInit(&res);
        tzset();
        tmv = localtime(&timestamp);