diff --git a/crypto/asn1/a_gentm.c b/crypto/asn1/a_gentm.c
index c91d506..3e6f14e 100644
--- a/crypto/asn1/a_gentm.c
+++ b/crypto/asn1/a_gentm.c
@@ -237,6 +237,11 @@
             goto err;
     }
 
+    if (ts->tm_year < 0 - 1900 || ts->tm_year > 9999 - 1900) {
+        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_TIME_VALUE);
+        goto err;
+    }
+
     p = (char *)tmps->data;
     if ((p == NULL) || ((size_t)tmps->length < len)) {
         p = OPENSSL_malloc(len);
diff --git a/crypto/asn1/asn1_test.cc b/crypto/asn1/asn1_test.cc
index e7dfaa9..bc6e3f7 100644
--- a/crypto/asn1/asn1_test.cc
+++ b/crypto/asn1/asn1_test.cc
@@ -478,8 +478,11 @@
     // disable the tests on 32-bit. Re-enable them once the bug is fixed.
     {2524607999, "20491231235959Z", "491231235959Z"},
     {2524608000, "20500101000000Z", nullptr},
-    // TODO(davidben): Fix and then test boundary conditions for GeneralizedTime
-    // years.
+    // Test boundary conditions.
+    {-62167219200, "00000101000000Z", nullptr},
+    {-62167219201, nullptr, nullptr},
+    {253402300799, "99991231235959Z", nullptr},
+    {253402300800, nullptr, nullptr},
 #endif
   };
   for (const auto &t : kTests) {