diff options
author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-09 21:42:22 +0100 |
---|---|---|
committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-09 21:42:22 +0100 |
commit | cbf9c76fa146739fc6bb1aa0f86bd2df680429fc (patch) | |
tree | 652e90e312ea9771072b8c4de57d835bda8ebaef | |
parent | 93407f6d3234ae3f036154d69f07da291eff34ff (diff) | |
download | libxslt-cbf9c76fa146739fc6bb1aa0f86bd2df680429fc.tar.gz |
date: Fix integer overflow in exsltDateFormatDuration
Make sure that months and days of durations can be negated.
Found by OSS-Fuzz.
-rw-r--r-- | libexslt/date.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libexslt/date.c b/libexslt/date.c index 9d8ccd61..21214a1f 100644 --- a/libexslt/date.c +++ b/libexslt/date.c @@ -1740,16 +1740,16 @@ _exsltDateAddDurCalc (exsltDateDurValPtr ret, exsltDateDurValPtr x, exsltDateDurValPtr y) { /* months */ - if ((x->mon > 0 && y->mon > LONG_MAX - x->mon) || - (x->mon < 0 && y->mon < LONG_MIN - x->mon)) { + if ((x->mon > 0 && y->mon > LONG_MAX - x->mon) || + (x->mon < 0 && y->mon <= LONG_MIN - x->mon)) { /* Overflow */ return 0; } ret->mon = x->mon + y->mon; /* days */ - if ((x->day > 0 && y->day > LONG_MAX - x->day) || - (x->day < 0 && y->day < LONG_MIN - x->day)) { + if ((x->day > 0 && y->day > LONG_MAX - x->day) || + (x->day < 0 && y->day <= LONG_MIN - x->day)) { /* Overflow */ return 0; } |