Describe the issue
absl::ParseTime() appears to accept input that contains embedded '\0' and trailing non-time data, by parsing only the prefix before '\0'.
Observed behavior:
"2025-01-01T00:00:00+00:00admin=true" is rejected (expected).
"2025-01-01T00:00:00+00:00\0admin=true" is accepted (unexpected).
This can bypass some validation when inputs come from length-delimited/binary sources.
Steps to reproduce the problem
#include <iostream>
#include <string>
#include "absl/time/time.h"
void RunCase(const std::string& label, const std::string& input) {
absl::Time parsed;
std::string err;
bool ok = absl::ParseTime(absl::RFC3339_full, input, absl::UTCTimeZone(),
&parsed, &err);
std::cout << label << ": input_size=" << input.size()
<< " ok=" << ok
<< " err=" << err;
if (ok) {
std::cout << " parsed="
<< absl::FormatTime(absl::RFC3339_full, parsed, absl::UTCTimeZone());
}
std::cout << "\n";
}
int main() {
const std::string base = "2025-01-01T00:00:00+00:00";
const std::string with_junk = base + "admin=true";
const std::string with_nul_junk("2025-01-01T00:00:00+00:00\0admin=true", 36);
RunCase("base", base);
RunCase("suffix-junk", with_junk);
RunCase("nul+suffix-junk", with_nul_junk);
return 0;
}
What version of Abseil are you using?
edeeb35
What operating system and version are you using?
macOS 15.4.1, arm64
What compiler and version are you using?
Homebrew clang 20.1.5
Target: arm64-apple-darwin24.4.0
What build system are you using?
Bazel 8.5.1-homebrew
Additional context
Found by fuzzing. If there are any concerns about this type of reporting, please let me know, and I will adjust my workflow accordingly.
Describe the issue
absl::ParseTime()appears to accept input that contains embedded'\0'and trailing non-time data, by parsing only the prefix before'\0'.Observed behavior:
"2025-01-01T00:00:00+00:00admin=true"is rejected (expected)."2025-01-01T00:00:00+00:00\0admin=true"is accepted (unexpected).This can bypass some validation when inputs come from length-delimited/binary sources.
Steps to reproduce the problem
What version of Abseil are you using?
edeeb35
What operating system and version are you using?
macOS 15.4.1, arm64
What compiler and version are you using?
Homebrew clang 20.1.5
Target: arm64-apple-darwin24.4.0
What build system are you using?
Bazel 8.5.1-homebrew
Additional context
Found by fuzzing. If there are any concerns about this type of reporting, please let me know, and I will adjust my workflow accordingly.