Decode: restrict timezone offset values (#696)

Don't allow hours greater than 24 and minutes greater than 60 per RFC 3339.
2021-12-02 17:59:32 -06:00
parent 9bf9be681e
commit f53bc740c1
2 changed files with 15 additions and 0 deletions
@@ -117,10 +117,17 @@ func parseDateTime(b []byte) (time.Time, error) {
 		if err != nil {
 			return time.Time{}, err
 		}
+		if hours > 24 {
+			return time.Time{}, newDecodeError(b[:1], "invalid timezone offset hours")
+		}
+
 		minutes, err := parseDecimalDigits(b[4:6])
 		if err != nil {
 			return time.Time{}, err
 		}
+		if minutes > 60 {
+			return time.Time{}, newDecodeError(b[:1], "invalid timezone offset minutes")
+		}

 		seconds := direction * (hours*3600 + minutes*60)
 		zone = time.FixedZone("", seconds)