Skip to content

Fix GH-16228 overflow on easter_days/easter_date year argument. - #16241

Closed
devnexen wants to merge 2 commits into
php:PHP-8.2from
devnexen:gh16228
Closed

devnexen wants to merge 2 commits into
php:PHP-8.2from
devnexen:gh16228

Conversation

@devnexen

@devnexen devnexen commented Oct 5, 2024

Copy link
Copy Markdown
Member

No description provided.

@devnexen devnexen linked an issue Oct 5, 2024 that may be closed by this pull request
Comment thread ext/calendar/easter.c Outdated
}
}

if (year < 0 || year > (ZEND_LONG_MAX - 1)) {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The computation dom = (year + (year/4) - (year/100) + (year/400)) % 7 can still overflow.
Also, year 0 does not exist.

Comment thread ext/calendar/easter.c Outdated

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The double cast is not necessary.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you come to the conclusion to divide by 1.25?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because year + (year/4) = 1.25*year;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, and because - (year/100) + (year/400) must be less than 0 this is indeed sufficient of course. This is right.

Comment thread ext/calendar/easter.c Outdated

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(zend_long)max_year can also be UB because it's not necessarily representable?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nvm this is not true.

@ndossche

ndossche commented Oct 5, 2024

Copy link
Copy Markdown
Member

@devnexen This patch will work, I just missed some details sorry. I think however it's nicer if we avoid the double and only use zend_long.

@devnexen devnexen closed this in a3ff092 Oct 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Signed integer overflow in ext/calendar/easter.c:94

2 participants