1023437 - der_TimeStringToTime bounds checking for days in month is too relaxed

Status: RESOLVED WONTFIX

(NSS :: Libraries, defect, P3)

Description

[Camilo Viecco (:cviecco)]

Currently we only check that the days in month values are between 1 and 31 (inclusive) which means a Feb 31 day is considered valid.

const uint8_t DER_GENERALIZED_TIME_INVALID_DAY_FEB[] = {
  0x18,
  15,
  '1', '9', '9', '1', '0', '2', '3', '0', '1', '6', '4', '5', '4', '0', 'Z'
  };

is decoded successfully (by DER_GeneralizedTimeToTime which calls derTimeStringToTime) returning 667932340000000 which is  Sat, 02 Mar 1991 16:45:40 GMT.

expected result: failure