[glib: 1/3] gdate: Limit length of dates which can be parsed as valid

[Sebastian Dröge <sdroege src gnome org>]

commit 15634d64bf6fb66c438ad536e65423170118985f
Author: Philip Withnall <pwithnall endlessos org>
Date:   Fri Dec 18 11:38:31 2020 +0000

    gdate: Limit length of dates which can be parsed as valid
    
    Realistically any date over 200 bytes long is not going to be valid, so
    limit the input length so we can’t spend too long doing UTF-8 validation
    or normalisation.
    
    oss-fuzz#28718
    
    Signed-off-by: Philip Withnall <pwithnall endlessos org>

 glib/gdate.c      | 7 +++++++
 glib/tests/date.c | 4 ++++
 2 files changed, 11 insertions(+)
---
diff --git a/glib/gdate.c b/glib/gdate.c
index 391b142a8..0e03a6e70 100644
--- a/glib/gdate.c
+++ b/glib/gdate.c
@@ -1229,12 +1229,19 @@ g_date_set_parse (GDate       *d,
 {
   GDateParseTokens pt;
   guint m = G_DATE_BAD_MONTH, day = G_DATE_BAD_DAY, y = G_DATE_BAD_YEAR;
+  gsize str_len;
   
   g_return_if_fail (d != NULL);
   
   /* set invalid */
   g_date_clear (d, 1);
 
+  /* Anything longer than this is ridiculous and could take a while to normalize.
+   * This limit is chosen arbitrarily. */
+  str_len = strlen (str);
+  if (str_len > 200)
+    return;
+
   /* The input has to be valid UTF-8. */
   if (!g_utf8_validate (str, -1, NULL))
     return;
diff --git a/glib/tests/date.c b/glib/tests/date.c
index 38de1d9be..542293c4b 100644
--- a/glib/tests/date.c
+++ b/glib/tests/date.c
@@ -191,6 +191,10 @@ test_parse_invalid (void)
     {
       /* Incomplete UTF-8 sequence */
       "\xfd",
+      /* Ridiculously long input */
+      "12345678901234567890123456789012345678901234567890123456789012345678901234567890"
+      "12345678901234567890123456789012345678901234567890123456789012345678901234567890"
+      "12345678901234567890123456789012345678901234567890123456789012345678901234567890",
     };
   gsize i;