Skip to content

gtimer: Add overflow checks to g_time_val_from_iso8601()

The code was previously doing a few bits of arithmetic without checking whether they would overflow, and hence not validating the date/time it was parsing very strictly.

The parser is now not 100% strict, but should avoid any arithmetic overflows which would cause an invalid result to be returned even though g_time_val_from_iso8601() had returned TRUE.


While this was flagged up by oss-fuzz, I’m not treating it as a particularly critical security issue. While it means people could input an invalid ISO-8601 date and have it treated as a valid date, the integer overflows in question are confined to the date handling — unless someone’s using a date as an offset into a block of memory on the heap, I don’t think this is generally exploitable.

Merge request reports