[PATCH] HTTP Compliance: Make date parser more strict to better handle extended Expires

[Alex Rousskov]

HTTP Compliance: Make date parser more strict to better handle extended 
Expires

Check that there is no zone or zone is "GMT" in parse_date_elements().
Make sure there is no junk at the end of date in parse_date().
Co-Advisor test case:
    test_case/rfc2616/invalidExpiresMakesStale-rfc1123x
HTTP Compliance: Make date parser more strict to better handle extended Expires

Check that there is no zone or zone is "GMT" in parse_date_elements().
Make sure there is no junk at the end of date in parse_date().

Co-Advisor test case:
    test_case/rfc2616/invalidExpiresMakesStale-rfc1123x

=== modified file 'lib/rfc1123.c'
--- lib/rfc1123.c	2010-03-31 15:59:21 +0000
+++ lib/rfc1123.c	2010-09-19 07:26:04 +0000
@@ -96,41 +96,41 @@ tmSaneValues(struct tm *tm)
     if (tm->tm_sec < 0 || tm->tm_sec > 59)
         return 0;
     if (tm->tm_min < 0 || tm->tm_min > 59)
         return 0;
     if (tm->tm_hour < 0 || tm->tm_hour > 23)
         return 0;
     if (tm->tm_mday < 1 || tm->tm_mday > 31)
         return 0;
     if (tm->tm_mon < 0 || tm->tm_mon > 11)
         return 0;
     return 1;
 }
 
 static struct tm *
 parse_date_elements(const char *day, const char *month, const char *year,
                     const char *aTime, const char *zone) {
     static struct tm tm;
     char *t;
     memset(&tm, 0, sizeof(tm));
 
-    if (!day || !month || !year || !aTime)
+    if (!day || !month || !year || !aTime || (zone && strcmp(zone, "GMT")))
         return NULL;
     tm.tm_mday = atoi(day);
     tm.tm_mon = make_month(month);
     if (tm.tm_mon < 0)
         return NULL;
     tm.tm_year = atoi(year);
     if (strlen(year) == 4)
         tm.tm_year -= 1900;
     else if (tm.tm_year < 70)
         tm.tm_year += 100;
     else if (tm.tm_year > 19000)
         tm.tm_year -= 19000;
     tm.tm_hour = make_num(aTime);
     t = strchr(aTime, ':');
     if (!t)
         return NULL;
     t++;
     tm.tm_min = atoi(t);
     t = strchr(t, ':');
     if (t)
@@ -153,46 +153,50 @@ parse_date(const char *str) {
     xstrncpy(tmp, str, 64);
 
     for (t = strtok(tmp, ", "); t; t = strtok(NULL, ", ")) {
         if (xisdigit(*t)) {
             if (!day) {
                 day = t;
                 t = strchr(t, '-');
                 if (t) {
                     *t++ = '\0';
                     month = t;
                     t = strchr(t, '-');
                     if (!t)
                         return NULL;
                     *t++ = '\0';
                     year = t;
                 }
             } else if (strchr(t, ':'))
                 timestr = t;
             else if (!year)
                 year = t;
+            else
+                return NULL;
         } else if (!wday)
             wday = t;
         else if (!month)
             month = t;
         else if (!zone)
             zone = t;
+        else
+            return NULL;
     }
     tm = parse_date_elements(day, month, year, timestr, zone);
 
     return tm;
 }
 
 time_t
 parse_rfc1123(const char *str)
 {
     struct tm *tm;
     time_t t;
     if (NULL == str)
         return -1;
     tm = parse_date(str);
     if (!tm)
         return -1;
     tm->tm_isdst = -1;
 #if HAVE_TIMEGM
     t = timegm(tm);
 #elif HAVE_TM_TM_GMTOFF