2027609 - uint32_t Integer overflow in non-ISO Date parser

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Jan de Mooij [:jandem]]

SpiderMonkey accepts large inputs like this:

print(new Date("4294967303").toISOString());
// 4294967303 mod 2^32 = 7 → parsed as month 7 (July), defaulted to July 1, 2001.

Both V8 and JSC reject this one in their date parsers.

Comment 1

[André Bargull [:anba]]

Attachment: Bug 2027609: Reject overlong number fields when parsing dates. r=#spidermonkey-reviewers!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/881753f8cde5
https://hg.mozilla.org/integration/autoland/rev/7bbfc33f15ef
Reject overlong number fields when parsing dates. r=spidermonkey-reviewers,mgaudet

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/7bbfc33f15ef