From 5d3aab8b227d367fd35f323d58a0a81e8275ea6f Mon Sep 17 00:00:00 2001 From: "Yukihiro \"Matz\" Matsumoto" Date: Tue, 10 Feb 2026 23:34:30 +0900 Subject: [PATCH] mruby-time: fix integer overflow in timegm() year calculation OUTINT macro checked ayear > INT_MAX, but timegm() later computes tm_year + TM_YEAR_BASE (1900), which overflows when tm_year is near INT_MAX. Tighten the upper bound to INT_MAX - TM_YEAR_BASE. Found by ClusterFuzz. Co-authored-by: Claude --- mrbgems/mruby-time/src/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mrbgems/mruby-time/src/time.c b/mrbgems/mruby-time/src/time.c index ac826a084..d554283c8 100644 --- a/mrbgems/mruby-time/src/time.c +++ b/mrbgems/mruby-time/src/time.c @@ -651,7 +651,7 @@ time_mktime(mrb_state *mrb, mrb_int ayear, mrb_int amonth, mrb_int aday, struct tm nowtime = { 0 }; #if MRB_INT_MAX > INT_MAX -#define OUTINT(x) (((MRB_TIME_T_UINT ? 0 : INT_MIN) > (x)) || (x) > INT_MAX) +#define OUTINT(x) (((MRB_TIME_T_UINT ? 0 : INT_MIN) > (x)) || (x) > INT_MAX - TM_YEAR_BASE) #else #define OUTINT(x) 0 #endif