Skip to content

Commit 4828f73

Browse files
committed
Integer overflow in SndToJewish leads to php hang
AT least in (inputDay is long, metonicCycle is int): metonicCycle = (inputDay + 310) / 6940; So large value give strange (negative) results or php hangs. This is patch already applied in some linux distro.
1 parent 46b05bc commit 4828f73

File tree

2 files changed

+20
-1
lines changed

2 files changed

+20
-1
lines changed

ext/calendar/jewish.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,7 @@
272272
#define HALAKIM_PER_METONIC_CYCLE (HALAKIM_PER_LUNAR_CYCLE * (12 * 19 + 7))
273273

274274
#define JEWISH_SDN_OFFSET 347997
275+
#define JEWISH_SDN_MAX 38245310 /* year 103759, 100000 A.D. */
275276
#define NEW_MOON_OF_CREATION 31524
276277

277278
#define SUNDAY 0
@@ -519,7 +520,7 @@ void SdnToJewish(
519520
int tishri1After;
520521
int yearLength;
521522

522-
if (sdn <= JEWISH_SDN_OFFSET) {
523+
if (sdn <= JEWISH_SDN_OFFSET || sdn > JEWISH_SDN_MAX) {
523524
*pYear = 0;
524525
*pMonth = 0;
525526
*pDay = 0;

ext/calendar/tests/jdtojewish64.phpt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Integer overflow in SndToJewish leads to php hang
3+
--SKIPIF--
4+
<?php
5+
include 'skipif.inc';
6+
if (PHP_INT_SIZE == 4) {
7+
die("skip this test is for 64bit platform only");
8+
}
9+
?>
10+
--FILE--
11+
<?php
12+
$a = array(38245310, 38245311, 9223372036854743639);
13+
14+
foreach ($a as $x) var_dump(jdtojewish($x));
15+
--EXPECTF--
16+
string(11) "2/22/103759"
17+
string(5) "0/0/0"
18+
string(5) "0/0/0"

0 commit comments

Comments
 (0)