summaryrefslogtreecommitdiff
path: root/ext/xmlrpc/libxmlrpc/xmlrpc.c
diff options
context:
space:
mode:
authorXinchen Hui <laruence@php.net>2015-03-25 13:05:08 +0800
committerXinchen Hui <laruence@php.net>2015-03-25 13:05:08 +0800
commitfe0ca2745f00940a27bfc8e87db534541a19af70 (patch)
tree9f6ecb6d7dd517f46f71bfc12cdeebd17f8fc904 /ext/xmlrpc/libxmlrpc/xmlrpc.c
parentef2db26c60537e84b502608ff404263d5f4dc5d2 (diff)
parent968fbc6acf0bc27be17c0209be7f966e89a55943 (diff)
downloadphp-git-fe0ca2745f00940a27bfc8e87db534541a19af70.tar.gz
Merge branch 'PHP-5.4' of https://git.php.net/repository/php-src into PHP-5.4
Diffstat (limited to 'ext/xmlrpc/libxmlrpc/xmlrpc.c')
-rw-r--r--ext/xmlrpc/libxmlrpc/xmlrpc.c13
1 files changed, 8 insertions, 5 deletions
diff --git a/ext/xmlrpc/libxmlrpc/xmlrpc.c b/ext/xmlrpc/libxmlrpc/xmlrpc.c
index ce70c2afd9..b766a5495a 100644
--- a/ext/xmlrpc/libxmlrpc/xmlrpc.c
+++ b/ext/xmlrpc/libxmlrpc/xmlrpc.c
@@ -219,16 +219,19 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
n = 10;
tm.tm_mon = 0;
for(i = 0; i < 2; i++) {
- XMLRPC_IS_NUMBER(text[i])
+ XMLRPC_IS_NUMBER(text[i+4])
tm.tm_mon += (text[i+4]-'0')*n;
n /= 10;
}
tm.tm_mon --;
+ if(tm.tm_mon < 0 || tm.tm_mon > 11) {
+ return -1;
+ }
n = 10;
tm.tm_mday = 0;
for(i = 0; i < 2; i++) {
- XMLRPC_IS_NUMBER(text[i])
+ XMLRPC_IS_NUMBER(text[i+6])
tm.tm_mday += (text[i+6]-'0')*n;
n /= 10;
}
@@ -236,7 +239,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
n = 10;
tm.tm_hour = 0;
for(i = 0; i < 2; i++) {
- XMLRPC_IS_NUMBER(text[i])
+ XMLRPC_IS_NUMBER(text[i+9])
tm.tm_hour += (text[i+9]-'0')*n;
n /= 10;
}
@@ -244,7 +247,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
n = 10;
tm.tm_min = 0;
for(i = 0; i < 2; i++) {
- XMLRPC_IS_NUMBER(text[i])
+ XMLRPC_IS_NUMBER(text[i+12])
tm.tm_min += (text[i+12]-'0')*n;
n /= 10;
}
@@ -252,7 +255,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
n = 10;
tm.tm_sec = 0;
for(i = 0; i < 2; i++) {
- XMLRPC_IS_NUMBER(text[i])
+ XMLRPC_IS_NUMBER(text[i+15])
tm.tm_sec += (text[i+15]-'0')*n;
n /= 10;
}