Skip to content

fix(frenchtojd): range-check zend_long args before narrowing to int - #23555

Open
lacatoire wants to merge 1 commit into
php:masterfrom
lacatoire:fix/frenchtojd-zend-long-narrowing
Open

fix(frenchtojd): range-check zend_long args before narrowing to int#23555
lacatoire wants to merge 1 commit into
php:masterfrom
lacatoire:fix/frenchtojd-zend-long-narrowing

Conversation

@lacatoire

Copy link
Copy Markdown
Member

Summary

FrenchToSdn() in ext/calendar/french.c takes C int parameters. PHP_FUNCTION(frenchtojd) parses into zend_long but passes them directly to FrenchToSdn(), causing implicit narrowing. Values whose low 32 bits alias into the valid range (e.g. month = 1 + 2**32) bypass the guard in french.c and return a valid-looking Julian Day instead of 0.

Fix

Add an explicit range check against the zend_long variables in PHP_FUNCTION(frenchtojd), before the call to FrenchToSdn(), mirroring the guard that already exists inside the helper:

if (year < 1 || year > 14 || month < 1 || month > 13 || day < 1 || day > 30) {
    RETURN_LONG(0);
}
RETURN_LONG(FrenchToSdn(year, month, day));

Valid inputs and already-out-of-range values (no aliasing) are unaffected.

Test added

ext/calendar/tests/frenchtojd_overflow.phpt covers the three aliased-overflow cases (month, day, year each + 2**32) and confirms a valid call still returns the correct Julian Day.

FrenchToSdn() takes C int parameters, so values like month=1+2**32
were silently truncated to their low 32 bits, aliasing into the valid
range and bypassing the guard in french.c.

Add an explicit range check against the zend_long variables in the
PHP_FUNCTION wrapper, mirroring the guard that already exists inside
FrenchToSdn(). This ensures out-of-range values always return 0,
matching the documented contract.

Fixes: #663
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant