Hello
-d accepts some invalid inputs. For example:
$ /usr/bin/date -d "("
Sun Jan 4 00:00:00 CET 2026
The patch in gnulib rejects it, the other add a test in coreutils
with the patch:
$ ./src/date -d '('
date: invalid date ‘(’
Note that /usr/bin/date -d "[", ".", "^" already generate an error
(found with a differential fuzzer)
Cheers
Sylvestre
From fa71d74984a8d96ca25928274e74f6986fec61d8 Mon Sep 17 00:00:00 2001
From: Sylvestre Ledru <[email protected]>
Date: Sun, 4 Jan 2026 18:26:21 +0100
Subject: [PATCH] parse-datetime: reject input with no meaningful date/time
information
Add validation after yyparse() succeeds to ensure at least one of
dates_seen, days_seen, times_seen, timespec_seen, or rels_seen
is set before considering the parse successful.
* lib/parse-datetime.y (parse_datetime_body): Add validation check
* tests/test-parse-datetime.c: Add test case for malformed input
---
lib/parse-datetime.y | 9 +++++++++
tests/test-parse-datetime.c | 6 ++++++
2 files changed, 15 insertions(+)
diff --git a/lib/parse-datetime.y b/lib/parse-datetime.y
index 6c52cd2c4c..2e3b9b256a 100644
--- a/lib/parse-datetime.y
+++ b/lib/parse-datetime.y
@@ -1902,6 +1902,15 @@ parse_datetime_body (struct timespec *result, char const *p,
goto fail;
}
+ /* Check if meaningful date/time information was parsed.
+ If no dates, days, times, timespecs, or relative time was seen, the input is invalid. */
+ if (!pc.dates_seen && !pc.days_seen && !pc.times_seen &&
+ !pc.timespec_seen && !pc.rels_seen)
+ {
+ if (debugging (&pc))
+ dbg_printf (_("error: no meaningful date/time information found\n"));
+ goto fail;
+ }
/* Determine effective timezone source. */
diff --git a/tests/test-parse-datetime.c b/tests/test-parse-datetime.c
index 23c8598a6f..e8281ddc11 100644
--- a/tests/test-parse-datetime.c
+++ b/tests/test-parse-datetime.c
@@ -523,5 +523,11 @@ main (_GL_UNUSED int argc, char **argv)
&& result.tv_nsec == 123456789);
}
+ /* Check rejection of malformed input with no meaningful date/time information */
+ now.tv_sec = SOME_TIMEPOINT + 4711;
+ now.tv_nsec = 1267;
+ p = "(";
+ ASSERT (!parse_datetime (&result, p, &now));
+
return test_exit_status;
}
--
2.47.3
From afb68733a262f5f4d237845631b2ea391c79312d Mon Sep 17 00:00:00 2001
From: Sylvestre Ledru <[email protected]>
Date: Sun, 4 Jan 2026 18:31:28 +0100
Subject: [PATCH] tests: date: add test for malformed input rejection
* tests/date/date.pl: Add test case 'invalid-paren' to verify that
malformed input like '(' is properly rejected
---
tests/date/date.pl | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tests/date/date.pl b/tests/date/date.pl
index 6971a7c7c..085e2d7dd 100755
--- a/tests/date/date.pl
+++ b/tests/date/date.pl
@@ -319,6 +319,9 @@ my @Tests =
# test with %%-N
['pct-pct', '+%%-N', {OUT => '%-N'}],
+
+ # test rejection of malformed input
+ ['invalid-paren', "-d '('", {ERR => "date: invalid date '('\n"}, {EXIT => 1}],
);
# Repeat the cross-dst test, using Jan 1, 2005 and every interval from 1..364.
--
2.47.3
