Skip to content

reject an empty quoted abbreviation in ParseAbbr - #367

Open
rajath201 wants to merge 1 commit into
google:masterfrom
rajath201:posix-empty-abbr
Open

reject an empty quoted abbreviation in ParseAbbr#367
rajath201 wants to merge 1 commit into
google:masterfrom
rajath201:posix-empty-abbr

Conversation

@rajath201

Copy link
Copy Markdown
Contributor

ParseAbbr() bounds the length of the unquoted abbreviation form but not the <...> one, so <> parses as a zero-length abbreviation. An empty dst_abbr is how PosixTimeZone signals "no daylight time" (time_zone_posix.h, and the if (posix.dst_abbr.empty()) branch in ExtendTransitions()), so a footer like EST5<>,M3.2.0,M11.1.0 loads with its DST rule quietly dropped and load_time_zone() still returns true. Looking up 2035-07-01T12:00:00Z gives -18000/EST against 2 transitions, where EST5EDT,M3.2.0,M11.1.0 gives -14400/EDT against 804; <>5 does the same to std_abbr and leaves %Z empty.

Add the matching length check to the quoted branch, beside the existing p - op < 3, so the constraint lives where the abbreviation is built instead of asking each consumer to treat empty as two different things. tzcode rejects the same input in tzparse() (if (!stdlen) return false;) and RFC 9636 wants at least one character between the brackets. No valid zone shifts: all 485 under testdata/zoneinfo give byte-identical descriptions, lookups, offsets and abbreviations before and after.

Comment thread src/time_zone_posix.cc
while (*++p != '>') {
if (*p == '\0') return nullptr;
}
if (p - op < 2) return nullptr; // no "<>"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that we know p - op >= 1 at this point, I would weaken the conditional to:

  if (p - op == 1) return nullptr;  // no "<>"

This also makes it very clear that the following size, (p - op) - 1, is not zero.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants