From 58e8c9c895cc21473d6e46978666016a6e627d5f Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 14 Jun 2016 13:07:27 +0000
Subject: [PATCH] date_strftime.c: check precision

* ext/date/date_strftime.c (date_strftime_with_tmx): reject too
  large precision to get rid of buffer overflow.
  reported by Guido Vranken <guido AT guidovranken.nl>.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55410 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog                       | 6 ++++++
 ext/date/date_strftime.c        | 9 +++++++--
 test/date/test_date_strftime.rb | 8 ++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 05fb3d50f9..fa058d2b33 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Tue Jun 14 22:07:25 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* ext/date/date_strftime.c (date_strftime_with_tmx): reject too
+	  large precision to get rid of buffer overflow.
+	  reported by Guido Vranken <guido AT guidovranken.nl>.
+
 Tue Jun 14 21:40:42 2016  Kazuki Yamaguchi  <k@rhe.jp>
 
 	* ext/openssl/ossl_ocsp.c (ossl_ocspbres_to_der, ossl_ocspcid_to_der):
diff --git a/ext/date/date_strftime.c b/ext/date/date_strftime.c
index 20931a3124..9d8167b612 100644
--- a/ext/date/date_strftime.c
+++ b/ext/date/date_strftime.c
@@ -48,7 +48,7 @@ downcase(char *s, size_t i)
 /* strftime --- produce formatted time */
 
 static size_t
-date_strftime_with_tmx(char *s, size_t maxsize, const char *format,
+date_strftime_with_tmx(char *s, const size_t maxsize, const char *format,
 		       const struct tmx *tmx)
 {
     char *endp = s + maxsize;
@@ -575,7 +575,12 @@ date_strftime_with_tmx(char *s, size_t maxsize, const char *format,
 	  case '5': case '6':  case '7': case '8': case '9':
 	    {
 		char *e;
-		precision = (int)strtoul(format, &e, 10);
+		unsigned long prec = strtoul(format, &e, 10);
+		if (prec > INT_MAX || prec > maxsize) {
+		    errno = ERANGE;
+		    return 0;
+		}
+		precision = (int)prec;
 		format = e - 1;
 		goto again;
 	    }
diff --git a/test/date/test_date_strftime.rb b/test/date/test_date_strftime.rb
index 7472a4323d..1c0f9b11b4 100644
--- a/test/date/test_date_strftime.rb
+++ b/test/date/test_date_strftime.rb
@@ -420,4 +420,12 @@ class TestDateStrftime < Test::Unit::TestCase
 
   end
 
+  def test_overflow
+    assert_raise(ArgumentError, Errno::ERANGE) {
+      Date.new(2000,1,1).strftime("%2147483647c")
+    }
+    assert_raise(ArgumentError, Errno::ERANGE) {
+      DateTime.new(2000,1,1).strftime("%2147483647c")
+    }
+  end
 end