admin/mruby-mruby
1
0
Fork 0
mirror of https://github.com/mruby/mruby synced 2026-06-08 16:11:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Validate tm values before timegm(); close #3368

Browse Source 
This issue was reported by https://hackerone.com/volc
This commit is contained in:
Yukihiro "Matz" Matsumoto
2017-01-09 10:42:11 +09:00
parent d3a8ebfadf
commit c4491e477b
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mrbgems/mruby-time/src/time.c
+9
View File
@@ -332,6 +332,15 @@ time_mktime(mrb_state *mrb, mrb_int ayear, mrb_int amonth, mrb_int aday,
nowtime.tm_min = (int)amin;
nowtime.tm_sec = (int)asec;
nowtime.tm_isdst = -1;
if (nowtime.tm_mon < 0 || nowtime.tm_mon > 11
|| nowtime.tm_mday < 1 || nowtime.tm_mday > 31
|| nowtime.tm_hour < 0 || nowtime.tm_hour > 24
|| (nowtime.tm_hour == 24 && (nowtime.tm_min > 0 || nowtime.tm_sec > 0))
|| nowtime.tm_min < 0 || nowtime.tm_min > 59
|| nowtime.tm_sec < 0 || nowtime.tm_sec > 60)
mrb_raise(mrb, E_RUNTIME_ERROR, "argument out of range");
if (timezone == MRB_TIMEZONE_UTC) {
nowsecs = timegm(&nowtime);
}