2 files changed, 6 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 0680466dd0..3c930dc56e 100644
--- a/NEWS
+++ b/NEWS
@@ -75,6 +75,7 @@ PHP                                                                        NEWS
 - Fixed bug #38456 (Apache2 segfaults when virtual() is called in .php
   ErrorDocument). (Ilia)
 - Fixed bug #36975 (natcasesort() causes array_pop() to misbehave). (Hannes)
+- Fixed bug #36644 (possible crash in variant_date_from_timestamp()). (Ilia)
 - Fixed bug #33282 (Re-assignment by reference does not clear the is_ref flag)
   (Ilia,Dmitry, Matt Wilmas)
 
diff --git a/ext/com_dotnet/com_variant.c b/ext/com_dotnet/com_variant.c
index ae350fe1d8..d45c094a70 100644
--- a/ext/com_dotnet/com_variant.c
+++ b/ext/com_dotnet/com_variant.c
@@ -798,6 +798,11 @@ PHP_FUNCTION(variant_date_from_timestamp)
 		return;
 	}
 
+	if (timestamp < 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Timestamp value must be a positive value.");
+		RETURN_FALSE;
+	}
+
 	VariantInit(&res);
 	tzset();
 	tmv = localtime(&timestamp);