@@ -1019,7 +1019,7 @@ of the timezone or altzone attributes on the time module.");
10191019#endif /* HAVE_MKTIME */
10201020
10211021#ifdef HAVE_WORKING_TZSET
1022- static void PyInit_timezone (PyObject * module );
1022+ static int PyInit_timezone (PyObject * module );
10231023
10241024static PyObject *
10251025time_tzset (PyObject * self , PyObject * unused )
@@ -1034,7 +1034,9 @@ time_tzset(PyObject *self, PyObject *unused)
10341034 tzset ();
10351035
10361036 /* Reset timezone, altzone, daylight and tzname */
1037- PyInit_timezone (m );
1037+ if (PyInit_timezone (m ) < 0 ) {
1038+ return NULL ;
1039+ }
10381040 Py_DECREF (m );
10391041 if (PyErr_Occurred ())
10401042 return NULL ;
@@ -1535,7 +1537,7 @@ get_zone(char *zone, int n, struct tm *p)
15351537#endif
15361538}
15371539
1538- static int
1540+ static time_t
15391541get_gmtoff (time_t t , struct tm * p )
15401542{
15411543#ifdef HAVE_STRUCT_TM_TM_ZONE
@@ -1546,8 +1548,11 @@ get_gmtoff(time_t t, struct tm *p)
15461548}
15471549#endif // !HAVE_DECL_TZNAME
15481550
1549- static void
1550- PyInit_timezone (PyObject * m ) {
1551+ static int
1552+ PyInit_timezone (PyObject * m )
1553+ {
1554+ assert (!PyErr_Occurred ());
1555+
15511556 /* This code moved from PyInit_time wholesale to allow calling it from
15521557 time_tzset. In the future, some parts of it can be moved back
15531558 (for platforms that don't HAVE_WORKING_TZSET, when we know what they
@@ -1591,19 +1596,31 @@ PyInit_timezone(PyObject *m) {
15911596 static const time_t YEAR = (365 * 24 + 6 ) * 3600 ;
15921597 time_t t ;
15931598 struct tm p ;
1594- long janzone , julyzone ;
1599+ time_t janzone_t , julyzone_t ;
15951600 char janname [10 ], julyname [10 ];
15961601 t = (time ((time_t * )0 ) / YEAR ) * YEAR ;
15971602 _PyTime_localtime (t , & p );
15981603 get_zone (janname , 9 , & p );
1599- janzone = - get_gmtoff (t , & p );
1604+ janzone_t = - get_gmtoff (t , & p );
16001605 janname [9 ] = '\0' ;
16011606 t += YEAR /2 ;
16021607 _PyTime_localtime (t , & p );
16031608 get_zone (julyname , 9 , & p );
1604- julyzone = - get_gmtoff (t , & p );
1609+ julyzone_t = - get_gmtoff (t , & p );
16051610 julyname [9 ] = '\0' ;
16061611
1612+ /* Sanity check, don't check for the validity of timezones.
1613+ In practice, it should be more in range -12 hours .. +14 hours. */
1614+ #define MAX_TIMEZONE (48 * 3600)
1615+ if (janzone_t < - MAX_TIMEZONE || janzone_t > MAX_TIMEZONE
1616+ || julyzone_t < - MAX_TIMEZONE || julyzone_t > MAX_TIMEZONE )
1617+ {
1618+ PyErr_SetString (PyExc_RuntimeError , "invalid GMT offset" );
1619+ return -1 ;
1620+ }
1621+ int janzone = (int )janzone_t ;
1622+ int julyzone = (int )julyzone_t ;
1623+
16071624 PyObject * tzname_obj ;
16081625 if (janzone < julyzone ) {
16091626 /* DST is reversed in the southern hemisphere */
@@ -1617,10 +1634,16 @@ PyInit_timezone(PyObject *m) {
16171634 PyModule_AddIntConstant (m , "daylight" , janzone != julyzone );
16181635 tzname_obj = Py_BuildValue ("(zz)" , janname , julyname );
16191636 }
1620- if (tzname_obj == NULL )
1621- return ;
1637+ if (tzname_obj == NULL ) {
1638+ return -1 ;
1639+ }
16221640 PyModule_AddObject (m , "tzname" , tzname_obj );
16231641#endif // !HAVE_DECL_TZNAME
1642+
1643+ if (PyErr_Occurred ()) {
1644+ return -1 ;
1645+ }
1646+ return 0 ;
16241647}
16251648
16261649
@@ -1721,7 +1744,9 @@ PyInit_time(void)
17211744 return NULL ;
17221745
17231746 /* Set, or reset, module variables like time.timezone */
1724- PyInit_timezone (m );
1747+ if (PyInit_timezone (m ) < 0 ) {
1748+ return NULL ;
1749+ }
17251750
17261751#if defined(HAVE_CLOCK_GETTIME ) || defined(HAVE_CLOCK_SETTIME ) || defined(HAVE_CLOCK_GETRES )
17271752
0 commit comments