Decoder: validate bounds of day and month in dates (#680)

Fixes #676
pelletier · Nov 24, 2021 · 8eae15b · 8eae15b
1 parent 2b3de62
commit 8eae15b
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/decode.go b/decode.go
@@ -462,7 +462,7 @@ func checkAndRemoveUnderscoresFloats(b []byte) ([]byte, error) {
 
 // isValidDate checks if a provided date is a date that exists.
 func isValidDate(year int, month int, day int) bool {
-	return day <= daysIn(month, year)
+	return month > 0 && month < 13 && day > 0 && day <= daysIn(month, year)
 }
 
 // daysBefore[m] counts the number of days in a non-leap year

diff --git a/unmarshaler_test.go b/unmarshaler_test.go
@@ -2570,6 +2570,14 @@ world'`,
 			desc: `invalid month`,
 			data: `a=2021-0--29`,
 		},
+		{
+			desc: `zero is an invalid day`,
+			data: `a=2021-11-00`,
+		},
+		{
+			desc: `zero is an invalid month`,
+			data: `a=2021-00-11`,
+		},
 		{
 			desc: `carriage return inside basic key`,
 			data: "\"\r\"=42",