diff --git a/ndn-cpp/c/errors.c b/ndn-cpp/c/errors.c
index a77a858..20f69ef 100644
--- a/ndn-cpp/c/errors.c
+++ b/ndn-cpp/c/errors.c
@@ -77,6 +77,8 @@
     return      "Name component does not begin with the expected marker";
   case NDN_ERROR_Time_functions_are_not_supported_by_the_standard_library:
     return      "Time functions are not supported by the standard library";
+  case NDN_ERROR_Calendar_time_value_out_of_range:
+    return      "Calendar time value out of range";
   default:
     return "unrecognized ndn_Error code";  
   }
diff --git a/ndn-cpp/c/errors.h b/ndn-cpp/c/errors.h
index 396f43d..852c892 100644
--- a/ndn-cpp/c/errors.h
+++ b/ndn-cpp/c/errors.h
@@ -46,7 +46,8 @@
   NDN_ERROR_SocketTransport_error_in_recv,
   NDN_ERROR_SocketTransport_error_in_close,
   NDN_ERROR_Name_component_does_not_begin_with_the_expected_marker,
-  NDN_ERROR_Time_functions_are_not_supported_by_the_standard_library
+  NDN_ERROR_Time_functions_are_not_supported_by_the_standard_library,
+  NDN_ERROR_Calendar_time_value_out_of_range
 } ndn_Error;
   
 /**
diff --git a/ndn-cpp/c/util/time.c b/ndn-cpp/c/util/time.c
index d1e2163..314eead 100644
--- a/ndn-cpp/c/util/time.c
+++ b/ndn-cpp/c/util/time.c
@@ -24,6 +24,12 @@
 ndn_toIsoString(ndn_MillisecondsSince1970 milliseconds, char *isoString)
 {
 #if NDN_CPP_HAVE_GMTIME_SUPPORT
+  if (milliseconds < 0)
+    return NDN_ERROR_Calendar_time_value_out_of_range;
+  else if (milliseconds > 2e14)
+    // 2e14 is about the year 8300.  We don't want to go over a 4-digit year.
+    return NDN_ERROR_Calendar_time_value_out_of_range;
+  
   double secondsSince1970 = milliseconds / 1000.0;
   char fractionBuffer[10];
   sprintf(fractionBuffer, "%.06lf", fmod(secondsSince1970, 1.0));