summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2017-06-16 13:48:19 -0700
committerChromium commit bot <commit-bot@chromium.org>2017-06-16 20:59:51 +0000
commit2bf942d8c21b653efdfdcae681769cffbfaa0663 (patch)
tree64c3e323c0ac00736db643f9a06976a52501761c /core
parent1e25e122849b0e16032f5b3d62bace4d3ce5253d (diff)
downloadpdfium-2bf942d8c21b653efdfdcae681769cffbfaa0663.tar.xz
Avoid a crash inside wcsftime() on Windows.chromium/3135chromium/3134chromium/3133
BUG=chromium:733245 Change-Id: Ic9347e2cc245831c0b71fac1d531c33c5646ab3f Reviewed-on: https://pdfium-review.googlesource.com/6671 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Nicolás Peña <npm@chromium.org>
Diffstat (limited to 'core')
-rw-r--r--core/fxcrt/fx_system.cpp2
-rw-r--r--core/fxcrt/fx_system_unittest.cpp16
2 files changed, 16 insertions, 2 deletions
diff --git a/core/fxcrt/fx_system.cpp b/core/fxcrt/fx_system.cpp
index cf1c7e5920..af883882b1 100644
--- a/core/fxcrt/fx_system.cpp
+++ b/core/fxcrt/fx_system.cpp
@@ -24,7 +24,7 @@ size_t FXSYS_wcsftime(wchar_t* strDest,
const struct tm* timeptr) {
// Avoid tripping an invalid parameter handler and crashing process.
// Note: leap seconds may cause tm_sec == 60.
- if (timeptr->tm_year < 0 || timeptr->tm_mon < 0 || timeptr->tm_mon > 11 ||
+ if (timeptr->tm_year < -1900 || timeptr->tm_mon < 0 || timeptr->tm_mon > 11 ||
timeptr->tm_mday < 1 || timeptr->tm_mday > 31 || timeptr->tm_hour < 0 ||
timeptr->tm_hour > 23 || timeptr->tm_min < 0 || timeptr->tm_min > 59 ||
timeptr->tm_sec < 0 || timeptr->tm_sec > 60 || timeptr->tm_wday < 0 ||
diff --git a/core/fxcrt/fx_system_unittest.cpp b/core/fxcrt/fx_system_unittest.cpp
index 5a7660d256..a83b275111 100644
--- a/core/fxcrt/fx_system_unittest.cpp
+++ b/core/fxcrt/fx_system_unittest.cpp
@@ -173,7 +173,21 @@ TEST(fxcrt, FXSYS_wcsftime) {
wchar_t buf[100] = {};
EXPECT_EQ(19u, FXSYS_wcsftime(buf, FX_ArraySize(buf), L"%Y-%m-%dT%H:%M:%S",
&good_time));
- EXPECT_EQ(std::wstring(L"1974-08-09T11:59:59"), buf);
+ EXPECT_STREQ(L"1974-08-09T11:59:59", buf);
+
+ // Ensure wcsftime handles a wide range of years without crashing.
+ struct tm year_time = {};
+ year_time.tm_mon = 7; // 0-based.
+ year_time.tm_mday = 9; // 1-based.
+ year_time.tm_hour = 11;
+ year_time.tm_min = 59;
+ year_time.tm_sec = 59;
+
+ for (int year = -2500; year <= 2500; ++year) {
+ year_time.tm_year = year;
+ wchar_t buf[100] = {};
+ FXSYS_wcsftime(buf, FX_ArraySize(buf), L"%Y-%m-%dT%H:%M:%S", &year_time);
+ }
// Ensure wcsftime handles bad years, etc. without crashing.
struct tm bad_time = {};