Created attachment 326496 [details]
PoC XSLT

When calculated, years are manipulated by "dates-and-times" functions as signed long. Their maximum value (on x64) is _I64_MAX aka 9223372036854775807. Values greater than _I64_MAX are accepted and will trigger an integer overflow, wrapping to negative values. If the value is greater than _UI64_MAX aka 18446744073709553592, the number is positive again.

That doesn't seem to have any security impact.

PoC (18446744073709553592 = _UI64_MAX + 1976):

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:date="http://exslt.org/dates-and-times">
 <xsl:template match="/">
 <xsl:value-of select="date:year('18446744073709553592')"/>
 </xsl:template>
</xsl:stylesheet>

Repro:

$ xsltproc x-year_long_overflow.xsl  empty.xml
<?xml version="1.0"?>
1976