Skip to content

[Bug]: absl::ParseTime returns unexpected results. #2014

@T90REAL

Description

@T90REAL

Describe the issue

absl::ParseTime() appears to accept input that contains embedded '\0' and trailing non-time data, by parsing only the prefix before '\0'.

Observed behavior:

  • "2025-01-01T00:00:00+00:00admin=true" is rejected (expected).
  • "2025-01-01T00:00:00+00:00\0admin=true" is accepted (unexpected).

This can bypass some validation when inputs come from length-delimited/binary sources.

Steps to reproduce the problem

#include <iostream>
#include <string>
#include "absl/time/time.h"

void RunCase(const std::string& label, const std::string& input) {
  absl::Time parsed;
  std::string err;
  bool ok = absl::ParseTime(absl::RFC3339_full, input, absl::UTCTimeZone(),
                            &parsed, &err);

  std::cout << label << ": input_size=" << input.size()
            << " ok=" << ok
            << " err=" << err;
  if (ok) {
    std::cout << " parsed="
              << absl::FormatTime(absl::RFC3339_full, parsed, absl::UTCTimeZone());
  }
  std::cout << "\n";
}

int main() {
  const std::string base = "2025-01-01T00:00:00+00:00";
  const std::string with_junk = base + "admin=true";
  const std::string with_nul_junk("2025-01-01T00:00:00+00:00\0admin=true", 36);

  RunCase("base", base);
  RunCase("suffix-junk", with_junk);
  RunCase("nul+suffix-junk", with_nul_junk);
  return 0;
}

What version of Abseil are you using?

edeeb35

What operating system and version are you using?

macOS 15.4.1, arm64

What compiler and version are you using?

Homebrew clang 20.1.5
Target: arm64-apple-darwin24.4.0

What build system are you using?

Bazel 8.5.1-homebrew

Additional context

Found by fuzzing. If there are any concerns about this type of reporting, please let me know, and I will adjust my workflow accordingly.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions