commit 4ba5d3176938d3435ddc7347cdc904658e2999ee
author Philip Withnall <philip.withnall@collabora.co.uk> Fri Jun 20 21:37:21 2014 +0100
committer Daniel Veillard <veillard@redhat.com> Sat Jul 26 20:20:11 2014 +0800
tree e1e3a173708befa941de27def300b10cfa46839a
parent 5777ae75ee0382149971a5bc2094f9d14e7e11f8

xmlschemastypes: Fix potential array overflow

The year and month need validating before being put into the
MAX_DAYINMONTH macro.

Coverity issue: #60436

https://bugzilla.gnome.org/show_bug.cgi?id=731990

xmlschemastypes.c

diff --git a/xmlschemastypes.c b/xmlschemastypes.c
index 7a56267..ff64f50 100644
--- a/xmlschemastypes.c
+++ b/xmlschemastypes.c
@@ -3854,7 +3854,8 @@
 	        tmon = 12;
             tempdays += MAX_DAYINMONTH(tyr, tmon);
             carry = -1;
-        } else if (tempdays > (long) MAX_DAYINMONTH(r->year, r->mon)) {
+        } else if (VALID_YEAR(r->year) && VALID_MONTH(r->mon) &&
+                   tempdays > (long) MAX_DAYINMONTH(r->year, r->mon)) {
             tempdays = tempdays - MAX_DAYINMONTH(r->year, r->mon);
             carry = 1;
         } else