- Added tests and NEWS for r306475; see bug #55797.

- Removed now redundant previous overflow check, which relied on
  undefined behavior (wraparound) and was ignored in optimized builds.

diff --git a/ext/calendar/gregor.c b/ext/calendar/gregor.c
index cf9860366c51afd8cc299444be1e1474c5f98f08..7e33d36c663be10a12557de37650e9c2b06c0f8a 100644 (file)
--- a/ext/calendar/gregor.c
+++ b/ext/calendar/gregor.c
@@ -153,10 +153,6 @@ void SdnToGregorian(
        }
        temp = (sdn + GREGOR_SDN_OFFSET) * 4 - 1;
 
-       if (temp < 0) {
-               goto fail;
-       }
-
        /* Calculate the century (year/100). */
        century = temp / DAYS_PER_400_YEARS;
 

diff --git a/ext/calendar/tests/bug55797_1.phpt b/ext/calendar/tests/bug55797_1.phpt
new file mode 100644 (file)
index 0000000..ffd617d
--- /dev/null
+++ b/ext/calendar/tests/bug55797_1.phpt
@@ -0,0 +1,36 @@
+--TEST--
+Bug #55797: Integer overflow in SdnToGregorian leads to segfault (in optimized builds)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if (PHP_INT_SIZE != 4) {
+        die("skip this test is for 32bit platform only");
+}
+?>
+--FILE--
+<?php
+$x = 882858030;
+
+var_dump(cal_from_jd($x, CAL_GREGORIAN));
+--EXPECTF--
+array(9) {
+  ["date"]=>
+  string(5) "0/0/0"
+  ["month"]=>
+  int(0)
+  ["day"]=>
+  int(0)
+  ["year"]=>
+  int(0)
+  ["dow"]=>
+  int(%d)
+  ["abbrevdayname"]=>
+  string(%d) "%s"
+  ["dayname"]=>
+  string(%d) "%s"
+  ["abbrevmonth"]=>
+  string(0) ""
+  ["monthname"]=>
+  string(0) ""
+}
+

diff --git a/ext/calendar/tests/bug55797_2.phpt b/ext/calendar/tests/bug55797_2.phpt
new file mode 100644 (file)
index 0000000..2a9183d
--- /dev/null
+++ b/ext/calendar/tests/bug55797_2.phpt
@@ -0,0 +1,36 @@
+--TEST--
+Bug #55797: Integer overflow in SdnToGregorian leads to segfault (in optimized builds)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+if (PHP_INT_SIZE == 4) {
+        die("skip this test is for 64bit platform only");
+}
+?>
+--FILE--
+<?php
+$x = 9223372036854743639;
+
+var_dump(cal_from_jd($x, CAL_GREGORIAN));
+--EXPECTF--
+array(9) {
+  ["date"]=>
+  string(5) "0/0/0"
+  ["month"]=>
+  int(0)
+  ["day"]=>
+  int(0)
+  ["year"]=>
+  int(0)
+  ["dow"]=>
+  int(%d)
+  ["abbrevdayname"]=>
+  string(%d) "%s"
+  ["dayname"]=>
+  string(%d) "%s"
+  ["abbrevmonth"]=>
+  string(0) ""
+  ["monthname"]=>
+  string(0) ""
+}
+