Problem reported by Naveed Khan.
* NEWS: Mention this.
* zic.c (rpytime): Check for integer overflow when multiplying a
repeat count by DAYSPERREPEAT.
---
NEWS | 9 +++++++++
zic.c | 8 ++++----
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/NEWS b/NEWS
index a04d6895..bb912dcb 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,15 @@ News for the tz database
Unreleased, experimental changes
+ Briefly:
+ Another integer overflow bug has been fixed in zic.
+
+ Changes to code
+
+ zic no longer overflows an integer when processing outlandish
+ input like ‘Zone Ouch 0 - LMT 9223372036854775807’. The integer
+ overflow is undefined behavior in C. (Thanks to Naveed Khan.)
+
Changes to commentary
The 2026-03-08 spring forward in Alberta and in Northwest
diff --git a/zic.c b/zic.c
index 7ecf3b91..1115e9ba 100644
--- a/zic.c
+++ b/zic.c
@@ -4128,11 +4128,11 @@ rpytime(const struct rule *rp, zic_t wantedy)
y = EPOCH_YEAR;
/* dayoff = floor((wantedy - y) / YEARSPERREPEAT) * DAYSPERREPEAT,
- sans overflow. */
+ checking for overflow. */
yrem = wantedy % YEARSPERREPEAT - y % YEARSPERREPEAT;
- dayoff = ((wantedy / YEARSPERREPEAT - y / YEARSPERREPEAT
- + yrem / YEARSPERREPEAT - (yrem % YEARSPERREPEAT < 0))
- * DAYSPERREPEAT);
+ dayoff = omul ((wantedy / YEARSPERREPEAT - y / YEARSPERREPEAT
+ + yrem / YEARSPERREPEAT - (yrem % YEARSPERREPEAT < 0)),
+ DAYSPERREPEAT);
/* wantedy = y + ((wantedy - y) mod YEARSPERREPEAT), sans overflow. */
wantedy = y + (yrem + 2 * YEARSPERREPEAT) % YEARSPERREPEAT;
--
2.54.0
