From 58bf401293bd1de3740613f586b5b970dc991d39 Mon Sep 17 00:00:00 2001 From: Josh Bleecher Snyder Date: Thu, 27 Dec 2018 14:23:29 -1000 Subject: [PATCH] time: reject tzdata with no zones Fixes #29437 Change-Id: Ice0a03a543e564d66651bfdfce5cd32ebaa35926 Reviewed-on: https://go-review.googlesource.com/c/155746 Run-TryBot: Josh Bleecher Snyder Reviewed-by: Ian Lance Taylor TryBot-Result: Gobot Gobot --- src/time/zoneinfo_read.go | 8 +++++++- src/time/zoneinfo_test.go | 9 +++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/src/time/zoneinfo_read.go b/src/time/zoneinfo_read.go index d54632fb490..1e559a62cc2 100644 --- a/src/time/zoneinfo_read.go +++ b/src/time/zoneinfo_read.go @@ -216,7 +216,13 @@ func LoadLocationFromTZData(name string, data []byte) (*Location, error) { // Now we can build up a useful data structure. // First the zone information. // utcoff[4] isdst[1] nameindex[1] - zone := make([]zone, n[NZone]) + nzone := n[NZone] + if nzone == 0 { + // Reject tzdata files with no zones. There's nothing useful in them. + // This also avoids a panic later when we add and then use a fake transition (golang.org/issue/29437). + return nil, badData + } + zone := make([]zone, nzone) for i := range zone { var ok bool var n uint32 diff --git a/src/time/zoneinfo_test.go b/src/time/zoneinfo_test.go index cd0731768e7..a7ef10c6bc3 100644 --- a/src/time/zoneinfo_test.go +++ b/src/time/zoneinfo_test.go @@ -173,3 +173,12 @@ func TestEarlyLocation(t *testing.T) { t.Errorf("Zone offset == %d, want %d", tzOffset, want) } } + +func TestMalformedTZData(t *testing.T) { + // The goal here is just that malformed tzdata results in an error, not a panic. + issue29437 := "TZif\x00000000000000000\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0000" + _, err := time.LoadLocationFromTZData("abc", []byte(issue29437)) + if err == nil { + t.Error("expected error, got none") + } +}