commit 79123ca9c0f9ae1532427f704fa626dbaebbdbe9
author Bob Beck <bbe@google.com> Sat Feb 03 13:48:50 2024 -0700
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> Sat Feb 03 21:18:04 2024 +0000
tree 66c7479546fd1cc25556de8fc157c701762713d4
parent 10a2132f50aaf7d49db7e258666f447b821588d9

Ensure additions in this call can't overflow.

from libressl

Change-Id: Iaec558fb6d3c698deb000c45b34aa94911e60a06
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/65967
Auto-Submit: Bob Beck <bbe@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>

crypto/asn1/posix_time.c

diff --git a/crypto/asn1/posix_time.c b/crypto/asn1/posix_time.c
index 5ac4eeb..2422bd3 100644
--- a/crypto/asn1/posix_time.c
+++ b/crypto/asn1/posix_time.c
@@ -143,6 +143,11 @@
 }
 
 int OPENSSL_tm_to_posix(const struct tm *tm, int64_t *out) {
+  // Ensure the additions below do not overflow.
+  if (tm->tm_year > 9999 || tm->tm_mon > 12) {
+    return 0;
+  }
+
   return posix_time_from_utc(tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
                              tm->tm_hour, tm->tm_min, tm->tm_sec, out);
 }