Avoid a crash inside wcsftime() on Windows.chromium/3135chromium/3134chromium/3133

BUG=chromium:733245

Change-Id: Ic9347e2cc245831c0b71fac1d531c33c5646ab3f
Reviewed-on: https://pdfium-review.googlesource.com/6671
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Nicolás Peña <npm@chromium.org>

2 files changed, 16 insertions, 2 deletions

diff --git a/core/fxcrt/fx_system.cpp b/core/fxcrt/fx_system.cpp
index cf1c7e5920..af883882b1 100644
--- a/core/fxcrt/fx_system.cpp
+++ b/core/fxcrt/fx_system.cpp
@@ -24,7 +24,7 @@ size_t FXSYS_wcsftime(wchar_t* strDest,
                       const struct tm* timeptr) {
   // Avoid tripping an invalid parameter handler and crashing process.
   // Note: leap seconds may cause tm_sec == 60.
-  if (timeptr->tm_year < 0 || timeptr->tm_mon < 0 || timeptr->tm_mon > 11 ||
+  if (timeptr->tm_year < -1900 || timeptr->tm_mon < 0 || timeptr->tm_mon > 11 ||
       timeptr->tm_mday < 1 || timeptr->tm_mday > 31 || timeptr->tm_hour < 0 ||
       timeptr->tm_hour > 23 || timeptr->tm_min < 0 || timeptr->tm_min > 59 ||
       timeptr->tm_sec < 0 || timeptr->tm_sec > 60 || timeptr->tm_wday < 0 ||
diff --git a/core/fxcrt/fx_system_unittest.cpp b/core/fxcrt/fx_system_unittest.cpp
index 5a7660d256..a83b275111 100644
--- a/core/fxcrt/fx_system_unittest.cpp
+++ b/core/fxcrt/fx_system_unittest.cpp
@@ -173,7 +173,21 @@ TEST(fxcrt, FXSYS_wcsftime) {
   wchar_t buf[100] = {};
   EXPECT_EQ(19u, FXSYS_wcsftime(buf, FX_ArraySize(buf), L"%Y-%m-%dT%H:%M:%S",
                                 &good_time));
-  EXPECT_EQ(std::wstring(L"1974-08-09T11:59:59"), buf);
+  EXPECT_STREQ(L"1974-08-09T11:59:59", buf);
+
+  // Ensure wcsftime handles a wide range of years without crashing.
+  struct tm year_time = {};
+  year_time.tm_mon = 7;   // 0-based.
+  year_time.tm_mday = 9;  // 1-based.
+  year_time.tm_hour = 11;
+  year_time.tm_min = 59;
+  year_time.tm_sec = 59;
+
+  for (int year = -2500; year <= 2500; ++year) {
+    year_time.tm_year = year;
+    wchar_t buf[100] = {};
+    FXSYS_wcsftime(buf, FX_ArraySize(buf), L"%Y-%m-%dT%H:%M:%S", &year_time);
+  }
 
   // Ensure wcsftime handles bad years, etc. without crashing.
   struct tm bad_time = {};