Fixes cctz::parse() to reject input with embedded NULs

derekmauro · derekmauro · commit 99e79411bb40 · 2026-02-12T12:08:22.000-05:00
Original report: abseil/abseil-cpp#2014
diff --git a/src/time_zone_format.cc b/src/time_zone_format.cc
@@ -974,7 +974,7 @@ bool parse(const std::string& format, const std::string& input,
   while (std::isspace(*data)) ++data;
 
   // parse() must consume the entire input string.
-  if (*data != '\0') {
+  if (data != input.data() + input.size()) {
     if (err != nullptr) *err = "Illegal trailing data in input string";
     return false;
   }
diff --git a/src/time_zone_format_test.cc b/src/time_zone_format_test.cc
@@ -896,6 +896,9 @@ TEST(Parse, ErrorCases) {
   EXPECT_FALSE(parse("%Ez", "+-0:00", tz, &tp));
   EXPECT_FALSE(parse("%z", "-00-0", tz, &tp));
   EXPECT_FALSE(parse("%Ez", "-00:-0", tz, &tp));
+
+  // Check that we do not accept strings with embedded NULs.
+  EXPECT_FALSE(parse("%Y", std::string("2026\0payload", 12), tz, &tp));
 }
 
 TEST(Parse, PosixConversions) {

Original file line number	Diff line number	Diff line change
`@@ -974,7 +974,7 @@ bool parse(const std::string& format, const std::string& input,`
`974`	`974`	`while (std::isspace(*data)) ++data;`
`975`	`975`
`976`	`976`	`// parse() must consume the entire input string.`
`977`		`- if (*data != '\0') {`
	`977`	`+ if (data != input.data() + input.size()) {`
`978`	`978`	`if (err != nullptr) *err = "Illegal trailing data in input string";`
`979`	`979`	`return false;`
`980`	`980`	`}`
Original file line number	Diff line number	Diff line change
`@@ -896,6 +896,9 @@ TEST(Parse, ErrorCases) {`
`896`	`896`	`EXPECT_FALSE(parse("%Ez", "+-0:00", tz, &tp));`
`897`	`897`	`EXPECT_FALSE(parse("%z", "-00-0", tz, &tp));`
`898`	`898`	`EXPECT_FALSE(parse("%Ez", "-00:-0", tz, &tp));`
	`899`	`+`
	`900`	`+ // Check that we do not accept strings with embedded NULs.`
	`901`	`+ EXPECT_FALSE(parse("%Y", std::string("2026\0payload", 12), tz, &tp));`
`899`	`902`	`}`
`900`	`903`
`901`	`904`	`TEST(Parse, PosixConversions) {`