Problem reported by Naveed Khan. * NEWS: Mention this. * zic.c (rpytime): Check for integer overflow when multiplying a repeat count by DAYSPERREPEAT. --- NEWS | 9 +++++++++ zic.c | 8 ++++---- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/NEWS b/NEWS index a04d6895..bb912dcb 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,15 @@ News for the tz database Unreleased, experimental changes + Briefly: + Another integer overflow bug has been fixed in zic. + + Changes to code + + zic no longer overflows an integer when processing outlandish + input like ‘Zone Ouch 0 - LMT 9223372036854775807’. The integer + overflow is undefined behavior in C. (Thanks to Naveed Khan.) + Changes to commentary The 2026-03-08 spring forward in Alberta and in Northwest diff --git a/zic.c b/zic.c index 7ecf3b91..1115e9ba 100644 --- a/zic.c +++ b/zic.c @@ -4128,11 +4128,11 @@ rpytime(const struct rule *rp, zic_t wantedy) y = EPOCH_YEAR; /* dayoff = floor((wantedy - y) / YEARSPERREPEAT) * DAYSPERREPEAT, - sans overflow. */ + checking for overflow. */ yrem = wantedy % YEARSPERREPEAT - y % YEARSPERREPEAT; - dayoff = ((wantedy / YEARSPERREPEAT - y / YEARSPERREPEAT - + yrem / YEARSPERREPEAT - (yrem % YEARSPERREPEAT < 0)) - * DAYSPERREPEAT); + dayoff = omul ((wantedy / YEARSPERREPEAT - y / YEARSPERREPEAT + + yrem / YEARSPERREPEAT - (yrem % YEARSPERREPEAT < 0)), + DAYSPERREPEAT); /* wantedy = y + ((wantedy - y) mod YEARSPERREPEAT), sans overflow. */ wantedy = y + (yrem + 2 * YEARSPERREPEAT) % YEARSPERREPEAT; -- 2.54.0