From 25ab5612f2ed8f0163c338740abd9f133af89356 Mon Sep 17 00:00:00 2001
From: attilamolnar
Date: Tue, 27 Aug 2013 18:33:32 +0200
Subject: Fix crash caused by passing a large integer to ctime()

In addition to verifying the return value of localtime(), correct tm_year if it is out of bounds

Reported by @JDowny
---
 src/helperfuncs.cpp | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

(limited to 'src/helperfuncs.cpp')

diff --git a/src/helperfuncs.cpp b/src/helperfuncs.cpp
index 5a8f55f11..439320c1e 100644
--- a/src/helperfuncs.cpp
+++ b/src/helperfuncs.cpp
@@ -495,7 +495,26 @@ bool InspIRCd::SilentULine(const std::string& sserver)
 
 std::string InspIRCd::TimeString(time_t curtime)
 {
-	return std::string(ctime(&curtime),24);
+#ifdef _WIN32
+	if (curtime < 0)
+		curtime = 0;
+#endif
+
+	struct tm* timeinfo = localtime(&curtime);
+	if (!timeinfo)
+	{
+		curtime = 0;
+		timeinfo = localtime(&curtime);
+	}
+
+	// If the calculated year exceeds four digits or is less than the year 1000,
+	// the behavior of asctime() is undefined
+	if (timeinfo->tm_year + 1900 > 9999)
+		timeinfo->tm_year = 9999 - 1900;
+	else if (timeinfo->tm_year + 1900 < 1000)
+		timeinfo->tm_year = 0;
+
+	return std::string(asctime(timeinfo),24);
 }
 
 // You should only pass a single character to this.
-- 
cgit v1.3.1-10-gc9f91