[pull] master from php:master

NEWS

@@ -10,6 +10,10 @@ PHP                                                                        NEWS
     recurses through zend_call_function, such as a self-attached SPL
     iterator). (iliaal)
 
+- Calendar:
+  . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
+    INT_MAX year). (arshidkv12)
+
 - DBA:
   . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
 

ext/calendar/gregor.c

@@ -209,6 +209,7 @@ zend_long GregorianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4714 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);

ext/calendar/julian.c

@@ -222,6 +222,7 @@ zend_long JulianToSdn(
 
 	/* check for invalid dates */
 	if (inputYear == 0 || inputYear < -4713 ||
+		inputYear > INT_MAX - 4800 ||
 		inputMonth <= 0 || inputMonth > 12 ||
 		inputDay <= 0 || inputDay > 31) {
 		return (0);

ext/calendar/tests/gh22602.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug GH-22602: (gregoriantojd() and juliantojd() integer overflow with INT_MAX year)
+--EXTENSIONS--
+calendar
+--FILE--
+<?php
+$max = PHP_INT_MAX > 2147483647 ? 2147483647 : PHP_INT_MAX;
+$min = PHP_INT_MAX > 2147483647 ? -2147483648 : PHP_INT_MIN;
+
+var_dump(gregoriantojd(5, 5, $max));
+var_dump(gregoriantojd(5, 5, $min));
+var_dump(juliantojd(5, 5, 2147483647));
+var_dump(juliantojd(5, 5, -2147483647));
+
+?>
+--EXPECT--
+int(0)
+int(0)
+int(0)
+int(0)