Out-of-bounds read in timegm

[clayton-shopify]

An out-of-bounds read can occur here, due to a missing bounds check:

mruby/mrbgems/mruby-time/src/time.c

Lines 133 to 134 in 158a6ab

	for (i = 0; i < tm->tm_mon; ++i)
	r += nday[i] * 24 * 60 * 60;

This can allow memory disclosure:

50.times { |i| puts Time.gm(1972, 12 + i + 1).to_i - Time.gm(1972, 12 + i).to_i }

or a crash:

Time.gm(1972, 0x100000)

MRI disallows months greater than 12, raising ArgumentError: argument out of range.

This issue was reported by https://hackerone.com/volc