reject an empty quoted abbreviation in ParseAbbr - #367
Open
rajath201 wants to merge 1 commit into
Open
Conversation
devbww
reviewed
Aug 6, 2026
| while (*++p != '>') { | ||
| if (*p == '\0') return nullptr; | ||
| } | ||
| if (p - op < 2) return nullptr; // no "<>" |
Contributor
There was a problem hiding this comment.
Given that we know p - op >= 1 at this point, I would weaken the conditional to:
if (p - op == 1) return nullptr; // no "<>"
This also makes it very clear that the following size, (p - op) - 1, is not zero.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ParseAbbr() bounds the length of the unquoted abbreviation form but not the
<...>one, so<>parses as a zero-length abbreviation. An empty dst_abbr is how PosixTimeZone signals "no daylight time" (time_zone_posix.h, and theif (posix.dst_abbr.empty())branch in ExtendTransitions()), so a footer likeEST5<>,M3.2.0,M11.1.0loads with its DST rule quietly dropped and load_time_zone() still returns true. Looking up 2035-07-01T12:00:00Z gives -18000/EST against 2 transitions, whereEST5EDT,M3.2.0,M11.1.0gives -14400/EDT against 804;<>5does the same to std_abbr and leaves %Z empty.Add the matching length check to the quoted branch, beside the existing
p - op < 3, so the constraint lives where the abbreviation is built instead of asking each consumer to treat empty as two different things. tzcode rejects the same input in tzparse() (if (!stdlen) return false;) and RFC 9636 wants at least one character between the brackets. No valid zone shifts: all 485 under testdata/zoneinfo give byte-identical descriptions, lookups, offsets and abbreviations before and after.