Fix Integer-overflow in base::Time::FromExploded.

base/time/time_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
 // Windows Timer Primer
 //
 // A good article:  http://www.ddj.com/windows/184416651
 // A good mozilla bug:  http://bugzilla.mozilla.org/show_bug.cgi?id=363258
 //
@@ skipping 91 matching lines @@
 // Returns the current value of the performance counter.
 uint64_t QPCNowRaw() {
   LARGE_INTEGER perf_counter_now = {};
   // According to the MSDN documentation for QueryPerformanceCounter(), this
   // will never fail on systems that run XP or later.
   // https://msdn.microsoft.com/library/windows/desktop/ms644904.aspx
   ::QueryPerformanceCounter(&perf_counter_now);
   return perf_counter_now.QuadPart;
 }
 
+// Maximum size of the
+const int kMaxWinWordSize = 65535;

[mmenke, 2016/10/18 15:04:50]

This should just be std::numeric_limits<WORD>::max()

+
 }  // namespace
 
 // Time -----------------------------------------------------------------------
 
 // The internal representation of Time uses FILETIME, whose epoch is 1601-01-01
 // 00:00:00 UTC.  ((1970-1601)*365+89)*24*60*60*1000*1000, where 89 is the
 // number of leap year days between 1601 and 1970: (1970-1601)/4 excluding
 // 1700, 1800, and 1900.
 // static
 const int64_t Time::kTimeTToMicrosecondsOffset = INT64_C(11644473600000000);
@@ skipping 107 matching lines @@
 }
 
 // static
 bool Time::IsHighResolutionTimerInUse() {
   base::AutoLock lock(g_high_res_lock.Get());
   return g_high_res_timer_enabled && g_high_res_timer_count > 0;
 }
 
 // static
 bool Time::FromExploded(bool is_local, const Exploded& exploded, Time* time) {
+  // Windows WORD has size of 2 bytes. Thus, maximum value that can be
+  // stored is 65535. If it is not possible to cast to WORD without an overflow,
+  // just return an error.
+  if (exploded.year > kMaxWinWordSize) {

[miu, 2016/10/18 19:55:13]

Suggestion:

  if (exploded.year > std::numeric_limits<WORD>::max()) {

...then you don't need the global constant.

Or, given mmenke's comment for the code on lines 252-260, maybe the code here
just goes away?

[maksims (do not use this acc), 2016/10/19 16:41:04]

Yes. Removed

+    *time = Time(0);
+    return false;
+  }
+
   // Create the system struct representing our exploded time. It will either be
   // in local time or UTC.
   SYSTEMTIME st;
   st.wYear = static_cast<WORD>(exploded.year);
   st.wMonth = static_cast<WORD>(exploded.month);
   st.wDayOfWeek = static_cast<WORD>(exploded.day_of_week);
   st.wDay = static_cast<WORD>(exploded.day_of_month);
   st.wHour = static_cast<WORD>(exploded.hour);
   st.wMinute = static_cast<WORD>(exploded.minute);
   st.wSecond = static_cast<WORD>(exploded.second);
   st.wMilliseconds = static_cast<WORD>(exploded.millisecond);

[mmenke, 2016/10/18 15:04:50]

Seems like this should be:

if (!SafeConvertToWord(exploded.year, &st.wYear) ||
    !SafeConvertToWord(exploded.month, &st.wMonth) ||
    ....) {
  *time = Time(0);
  return false;
}

And then something like:

bool SafeConvertToWord(int in, WORD* out) {
  CheckedNumeric<WORD> result = in;
  *out = result.ValueOrDefault(std::numeric_limits<WORD>::max());
  return result.IsValid();
}

In an anonymous namespace up top.

The advantage is it covers all parameters, which is good, since we want to
reject invalid times, and is more general - it doesn't depend on WORD being an
unsigned int16.  If that doesn't work for some reason, there's also
IsValueInRangeForNumericType.

[maksims (do not use this acc), 2016/10/19 16:41:04]

Done.

 
   FILETIME ft;
   bool success = true;
   // Ensure that it's in UTC.
   if (is_local) {
     SYSTEMTIME utc_st;
     success = TzSpecificLocalTimeToSystemTime(nullptr, &st, &utc_st) &&
               SystemTimeToFileTime(&utc_st, &ft);
   } else {
     success = !!SystemTimeToFileTime(&st, &ft);
@@ skipping 370 matching lines @@
 TimeTicks TimeTicks::FromQPCValue(LONGLONG qpc_value) {
   return TimeTicks() + QPCValueToTimeDelta(qpc_value);
 }
 
 // TimeDelta ------------------------------------------------------------------
 
 // static
 TimeDelta TimeDelta::FromQPCValue(LONGLONG qpc_value) {
   return QPCValueToTimeDelta(qpc_value);
 }