datetime: fix buffer overflow in tnt_strptime

Fixes tarantool#8502 Needed for tarantool#8490 NO_DOC=bugfix NO_TEST=covered by fuzzing test (cherry picked from commit 783a704)
ligurio · Aug 18, 2023 · 33f0726 · 33f0726
1 parent e35021f
commit 33f0726
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 4 deletions.
diff --git a/changelogs/unreleased/gh-8502-fix-buffer-overflow-in-tnt_strptime.md b/changelogs/unreleased/gh-8502-fix-buffer-overflow-in-tnt_strptime.md
@@ -0,0 +1,3 @@
+## bugfix/datetime
+
+* Fixed a bug with buffer overflow in tnt_strptime (gh-8502).
diff --git a/src/lib/tzcode/strptime.c b/src/lib/tzcode/strptime.c
@@ -125,9 +125,11 @@ tnt_strptime(const char *__restrict buf, const char *__restrict fmt,
 		c = *ptr++;
 
 		if (c != '%') {
-			if (isspace((u_char)c))
+			/* Eat up white-space in buffer and in format. */
+			if (isspace((u_char)c)) {
 				while (*buf != 0 && isspace((u_char)*buf))
 					buf++;
+			}
 			else if (c != *buf++)
 				return NULL;
 			continue;
@@ -661,9 +663,10 @@ tnt_strptime(const char *__restrict buf, const char *__restrict fmt,
 	if ((flags & (FLAG_YEAR | FLAG_YDAY)) == (FLAG_YEAR | FLAG_YDAY)) {
 		if (!(flags & FLAG_MONTH)) {
 			i = 0;
-			while (tm->tm_yday >=
-			       start_of_month[isleap(tm->tm_year +
-						     TM_YEAR_BASE)][i])
+			while (i <= 12 &&
+			       tm->tm_yday >=
+				       start_of_month[isleap(tm->tm_year +
+							     TM_YEAR_BASE)][i])
 				i++;
 			if (i > 12) {
 				i = 1;