From 8eae15b2eea879e3e7627c8b50763c7ed9a042db Mon Sep 17 00:00:00 2001
From: Thomas Pelletier <pelletier.thomas@gmail.com>
Date: Wed, 24 Nov 2021 17:42:01 -0500
Subject: [PATCH] Decoder: validate bounds of day and month in dates (#680)

Fixes #676
---
 decode.go           | 2 +-
 unmarshaler_test.go | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/decode.go b/decode.go
index 6dce72c..0223ebe 100644
--- a/decode.go
+++ b/decode.go
@@ -462,7 +462,7 @@ func checkAndRemoveUnderscoresFloats(b []byte) ([]byte, error) {
 
 // isValidDate checks if a provided date is a date that exists.
 func isValidDate(year int, month int, day int) bool {
-	return day <= daysIn(month, year)
+	return month > 0 && month < 13 && day > 0 && day <= daysIn(month, year)
 }
 
 // daysBefore[m] counts the number of days in a non-leap year
diff --git a/unmarshaler_test.go b/unmarshaler_test.go
index 29809ae..9f906ed 100644
--- a/unmarshaler_test.go
+++ b/unmarshaler_test.go
@@ -2570,6 +2570,14 @@ world'`,
 			desc: `invalid month`,
 			data: `a=2021-0--29`,
 		},
+		{
+			desc: `zero is an invalid day`,
+			data: `a=2021-11-00`,
+		},
+		{
+			desc: `zero is an invalid month`,
+			data: `a=2021-00-11`,
+		},
 		{
 			desc: `carriage return inside basic key`,
 			data: "\"\r\"=42",