Signed Integer Overflow in ext/date/lib/parse_posix.c

[YuanchengJiang]

Description

The following code:

<?php
echo date(DATE_ATOM."\n".DATE_RFC2822."\nc\nr\no\ny\nY\nU\n\n", PHP_INT_MAX);
?>

Resulted in this output:

/php-src/ext/date/lib/parse_posix.c:493:22: runtime error: signed integer overflow: 86400 * 106751991167328 cannot be represented in type 'long long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/date/lib/parse_posix.c:493:22 

To reproduce:

php -d "date.timezone=Europe/Rome" ./test.php

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[cmb69]

I think we need to catch time_t values which would cause overflow early in php_format_date(). There are apparently two problems, though:

• What is the maximum value of time_t on different platforms (see https://stackoverflow.com/questions/5617925/maximum-values-for-time-t-struct-timespec)
• What to return? An empty zend_string? Note that php_format_date() is a PHPAPI so might be used elsewhere. therefore it might not be the best idea to throw a ValueError

[cmb69]

Note that there is likely no real problem for 64bit architectures (where zend_long and time_t are 64bit signed), but for 32bit architectures (where zend_long and time_t are 32bit signed) it seems more likely (Y2038). And I wonder whether we can legitly assume that zend_long and time_t are the same for all supported architectures.