Decoder: validate bounds of day and month in dates (#680)

Fixes #676

decode.go

@@ -462,7 +462,7 @@ func checkAndRemoveUnderscoresFloats(b []byte) ([]byte, error) {
 
 // isValidDate checks if a provided date is a date that exists.
 func isValidDate(year int, month int, day int) bool {
-	return day <= daysIn(month, year)
+	return month > 0 && month < 13 && day > 0 && day <= daysIn(month, year)
 }
 
 // daysBefore[m] counts the number of days in a non-leap year

unmarshaler_test.go

@@ -2570,6 +2570,14 @@ world'`,
 			desc: `invalid month`,
 			data: `a=2021-0--29`,
 		},
+		{
+			desc: `zero is an invalid day`,
+			data: `a=2021-11-00`,
+		},
+		{
+			desc: `zero is an invalid month`,
+			data: `a=2021-00-11`,
+		},
 		{
 			desc: `carriage return inside basic key`,
 			data: "\"\r\"=42",