Fix IntlDateFormatter parse functions truncating an $offset below INT_MIN (#24781)

Check both bounds before narrowing the parse offset to int32_t. On 64-bit
systems, a value such as -4294967295 previously became 1 and parsing
started at the wrong position. Cover all three parse functions with a
regression test.

Closes #24781

Author: marc-mabe

NEWS

@@ -98,6 +98,10 @@ PHP                                                                        NEWS
 - Hash:
   . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)
 
+- Intl:
+  . Fixed IntlDateFormatter parse functions truncating an $offset below
+    INT_MIN. (Marc Bennewitz)
+
 - MBString:
   . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
   . Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead

ext/intl/dateformat/dateformat_parse.c

@@ -169,7 +169,7 @@ PHP_FUNCTION(datefmt_parse)
 		zval *z_parse_pos_tmp = z_parse_pos;
 		ZVAL_DEREF(z_parse_pos_tmp);
 		zend_long long_parse_pos = zval_get_long(z_parse_pos_tmp);
-		if (ZEND_LONG_INT_OVFL(long_parse_pos)) {
+		if (ZEND_LONG_EXCEEDS_INT(long_parse_pos)) {
 			intl_error_set_code(NULL, U_ILLEGAL_ARGUMENT_ERROR);
 			intl_error_set_custom_msg(NULL, "String index is out of valid range.", 0);
 			RETURN_FALSE;
@@ -212,7 +212,7 @@ PHP_METHOD(IntlDateFormatter, parseToCalendar)
 			zend_argument_type_error(2, "must be of type int, %s given", zend_zval_value_name(z_parse_pos));
 			RETURN_THROWS();
 		}
-		if (ZEND_LONG_INT_OVFL(long_parse_pos)) {
+		if (ZEND_LONG_EXCEEDS_INT(long_parse_pos)) {
 			intl_error_set_code(NULL, U_ILLEGAL_ARGUMENT_ERROR);
 			intl_error_set_custom_msg(NULL, "String index is out of valid range.", 0);
 			RETURN_FALSE;
@@ -251,7 +251,7 @@ PHP_FUNCTION(datefmt_localtime)
 		zval *z_parse_pos_tmp = z_parse_pos;
 		ZVAL_DEREF(z_parse_pos_tmp);
 		zend_long long_parse_pos = zval_get_long(z_parse_pos_tmp);
-		if (ZEND_LONG_INT_OVFL(long_parse_pos)) {
+		if (ZEND_LONG_EXCEEDS_INT(long_parse_pos)) {
 			intl_error_set_code(NULL, U_ILLEGAL_ARGUMENT_ERROR);
 			intl_error_set_custom_msg(NULL, "String index is out of valid range.", 0);
 			RETURN_FALSE;

ext/intl/tests/dateformat_parse_offset_out_of_range.phpt

@@ -0,0 +1,33 @@
+--TEST--
+IntlDateFormatter parse functions reject an offset below INT_MIN
+--EXTENSIONS--
+intl
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE <= 4) die('skip requires a 64-bit zend_long');
+?>
+--FILE--
+<?php
+/* -4294967295 used to be truncated to an int32_t of 1, so parsing started
+ * at offset 1 instead of failing. */
+$fmt = new IntlDateFormatter('en_US', IntlDateFormatter::FULL, IntlDateFormatter::FULL, 'UTC', null, 'yyyy');
+
+$offset = -4294967295;
+var_dump(datefmt_parse($fmt, '12026', $offset), $offset, intl_get_error_message());
+
+$offset = -4294967295;
+var_dump($fmt->parseToCalendar('12026', $offset), $offset, intl_get_error_message());
+
+$offset = -4294967295;
+var_dump(datefmt_localtime($fmt, '12026', $offset), $offset, intl_get_error_message());
+?>
+--EXPECTF--
+bool(false)
+int(-4294967295)
+string(%d) "%SString index is out of valid range.: U_ILLEGAL_ARGUMENT_ERROR"
+bool(false)
+int(-4294967295)
+string(%d) "%SString index is out of valid range.: U_ILLEGAL_ARGUMENT_ERROR"
+bool(false)
+int(-4294967295)
+string(%d) "%SString index is out of valid range.: U_ILLEGAL_ARGUMENT_ERROR"