Description:
------------
variant_date_from_timestamp fails when the value passed is PHP_INT_MAX. Only a check for negative values was implemented, see bug #36644


Code:
	VariantInit(&res);
	tzset();
	ttstamp = timestamp;
	tmv = localtime(&ttstamp);
	memset(&systime, 0, sizeof(systime));

---->	systime.wDay = tmv->tm_mday;
	systime.wHour = tmv->tm_hour;
	systime.wMinute = tmv->tm_min;
...

tmv->tm_mday fails and PHP interpreter crashes.

Test script:
---------------
<?php

$v1=PHP_INT_MAX;
variant_date_from_timestamp($v1);

Expected result:
----------------
No crash

Actual result:
--------------
(239c.2420): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
php_com_dotnet!zif_variant_date_from_timestamp+0x9b:
6229ac1b 0fb74a0c        movzx   ecx,word ptr [edx+0Ch]   ds:002b:0000000c=????
Processing initial command 'r;!exploitable -v'
0:000:x86> r;!exploitable -v
eax=00000000 ebx=16613020 ecx=46a6c679 edx=00000000 esi=16613070 edi=16676070
eip=6229ac1b esp=0915e3e0 ebp=0915e424 iopl=0         nv up ei pl nz ac po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010212
php_com_dotnet!zif_variant_date_from_timestamp+0x9b:
6229ac1b 0fb74a0c        movzx   ecx,word ptr [edx+0Ch]   ds:002b:0000000c=????

!exploitable 1.6.0.0
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
Exception Faulting Address: 0xc
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Read Access Violation

Faulting Instruction:6229ac1b movzx ecx,word ptr [edx+0ch]

Basic Block:
    6229ac1b movzx ecx,word ptr [edx+0ch]
       Tainted Input operands: 'edx'
    6229ac1f mov word ptr [esp+26h],cx
       Tainted Input operands: 'cx'
    6229ac24 movzx ecx,word ptr [edx+8]
       Tainted Input operands: 'edx'
    6229ac28 mov word ptr [esp+28h],cx
       Tainted Input operands: 'cx'
    6229ac2d movzx ecx,word ptr [edx+4]
       Tainted Input operands: 'edx'
    6229ac31 mov word ptr [esp+2ah],cx
       Tainted Input operands: 'cx'
    6229ac36 movzx eax,word ptr [edx+10h]
       Tainted Input operands: 'edx'
    6229ac3a inc ax
       Tainted Input operands: 'ax'
    6229ac3c mov word ptr [esp+22h],ax
       Tainted Input operands: 'ax'
    6229ac41 movzx eax,word ptr [edx]
       Tainted Input operands: 'edx'
    6229ac44 mov word ptr [esp+2ch],ax
       Tainted Input operands: 'ax'
    6229ac49 mov eax,76ch
    6229ac4e add ax,word ptr [edx+14h]
       Tainted Input operands: 'edx'
    6229ac52 mov word ptr [esp+20h],ax
       Tainted Input operands: 'ax'
    6229ac57 mov eax,7
    6229ac5c mov word ptr [esp+10h],ax
    6229ac61 lea eax,[esp+18h]
    6229ac65 push eax
    6229ac66 lea eax,[esp+24h]
    6229ac6a push eax
    6229ac6b call dword ptr [php_com_dotnet!_imp__systemtimetovarianttime (6229e09c)]
       Tainted Input operands: 'ecx','edx'

Exception Hash (Major/Minor): 0x2576e1cb.0x90cf1b1e

 Hash Usage : Stack Trace:
Major+Minor : php_com_dotnet!zif_variant_date_from_timestamp+0x9b
Major+Minor : php7!execute_ex+0xfb
Major+Minor : php7!zend_execute+0x124
Major+Minor : php7!zend_execute_scripts+0xe7
Major+Minor : php7!php_execute_script+0x369
Minor       : php!do_cli+0x3d3
Minor       : php!main+0x2cb
Minor       : php!__scrt_common_main_seh+0xff
Minor       : KERNEL32!BaseThreadInitThunk+0x24
Minor       : ntdll_77d90000!RtlUnicodeStringToInteger+0x253
Minor       : ntdll_77d90000!RtlUnicodeStringToInteger+0x21e
Instruction Address: 0x000000006229ac1b
Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.8\ext\com_dotnet\com_variant.c
Source Line: 1012