Fix phpGH-16834: cal_from_jd overflow on julian_day argument.

close phpGH-16836

Author: devnexen

NEWS

@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 
 - Calendar:
   . Fixed jdtogregorian overflow. (David Carlier)
+  . Fixed cal_to_jd julian_days argument overflow. (David Carlier)
 
 - Core:
   . Fail early in *nix configuration build script. (hakre)

ext/calendar/gregor.c

@@ -162,6 +162,11 @@ void SdnToGregorian(
 
 	/* Calculate the year and day of year (1 <= dayOfYear <= 366). */
 	temp = ((temp % DAYS_PER_400_YEARS) / 4) * 4 + 3;
+
+	if (century > ((INT_MAX / 100) - (temp / DAYS_PER_4_YEARS))) {
+		goto fail;
+	}
+
 	year = (century * 100) + (temp / DAYS_PER_4_YEARS);
 	dayOfYear = (temp % DAYS_PER_4_YEARS) / 4 + 1;
 

ext/calendar/tests/gh16834.phpt

@@ -0,0 +1,31 @@
+--TEST--
+GH-16834 (cal_from_jd from julian_day argument)
+--EXTENSIONS--
+calendar
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip for 64bit platforms only"); ?>
+--FILE--
+<?php
+var_dump(cal_from_jd(076545676543223, CAL_GREGORIAN));
+?>
+--EXPECTF--
+array(9) {
+  ["date"]=>
+  string(5) "0/0/0"
+  ["month"]=>
+  int(0)
+  ["day"]=>
+  int(0)
+  ["year"]=>
+  int(0)
+  ["dow"]=>
+  int(%d)
+  ["abbrevdayname"]=>
+  string(3) "%s"
+  ["dayname"]=>
+  string(9) "%s"
+  ["abbrevmonth"]=>
+  string(0) ""
+  ["monthname"]=>
+  string(0) ""
+}