Fuzzing Issue in DateTime

[obiltschnig]

https://issues.oss-fuzz.com/issues/471415254

[obiltschnig]

clusterfuzz-testcase-minimized-date_time_fuzzer-4940490710777856.zip

  | [Environment] ASAN_OPTIONS=exitcode=77
-- | --
  | +----------------------------------------Release Build Stacktrace----------------------------------------+
  | Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-78f1521aec9e55e8f6602fe4083903864a79c929
  | Time ran: 0.043917179107666016
  |  
  | INFO: Running with entropic power schedule (0xFF, 100).
  | INFO: Seed: 3457822186
  | INFO: Loaded 1 modules   (18237 inline 8-bit counters): 18237 [0x56b2b69af0a0, 0x56b2b69b37dd),
  | INFO: Loaded 1 PC tables (18237 PCs): 18237 [0x56b2b69b37e0,0x56b2b69fabb0),
  | /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer: Running 1 inputs 100 time(s) each.
  | Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-78f1521aec9e55e8f6602fe4083903864a79c929
  | libc++abi: terminating due to uncaught exception of type Poco::InvalidArgumentException: Invalid argument
  | ==248== ERROR: libFuzzer: deadly signal
  | #0 0x56b2b66dee61 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
  | #1 0x56b2b65d0c08 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5
  | #2 0x56b2b65b3755 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:231:3
  | #3 0x7f571519a41f in libpthread.so.0
  | #4 0x7f5714e3f00a in __libc_signal_restore_set /build/glibc-B3wQXB/glibc-2.31/sysdeps/unix/sysv/linux/internal-signals.h:86:3
  | #5 0x7f5714e3f00a in raise /build/glibc-B3wQXB/glibc-2.31/sysdeps/unix/sysv/linux/raise.c:48:3
  | #6 0x7f5714e1e858 in abort /build/glibc-B3wQXB/glibc-2.31/stdlib/abort.c:79:7
  | #7 0x56b2b65951b5 in __abort_message
  | #8 0x56b2b68c83f8 in demangling_terminate_handler() cxa_default_handlers.cpp:0
  | #9 0x56b2b6877a12 in std::__terminate(void (*)())
  | #10 0x56b2b6879525 in __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) cxa_exception.cpp:0
  | #11 0x56b2b687950f in __cxa_throw
  | #12 0x56b2b671aa0b in Poco::DateTime::checkValid() poco/Foundation/src/DateTime.cpp:216:3
  | #13 0x56b2b671e92c in Poco::DateTime::operator+=(Poco::Timespan const&) poco/Foundation/src/DateTime.cpp:292:2
  | #14 0x56b2b671e92c in Poco::DateTime::makeLocal(int) poco/Foundation/src/DateTime.cpp:337:2
  | #15 0x56b2b6717ea4 in LLVMFuzzerTestOneInput poco/Foundation/fuzzing/DateTimeParse.cpp:34:5
  | #16 0x56b2b65b4e3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
  | #17 0x56b2b659fbb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
  | #18 0x56b2b65a5a80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
  | #19 0x56b2b65d15b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
  | #20 0x7f5714e20082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
  | #21 0x56b2b6598c9d in _start
  |  
  | NOTE: libFuzzer has rudimentary signal handlers.
  | Combine libFuzzer with AddressSanitizer or similar for better crash reports.
  | SUMMARY: libFuzzer: deadly signal
  |  
  |  
  | +----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+
  |  
  | libc++abi: terminating due to uncaught exception of type Poco::InvalidArgumentException: Invalid argument
  | ==248== ERROR: libFuzzer: deadly signal
  | #0 0x56b2b66dee61  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x217e61)
  | #1 0x56b2b65d0c08  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x109c08)
  | #2 0x56b2b65b3755  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xec755)
  | #3 0x7f571519a41f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078)
  | #4 0x7f5714e3f00a  (/lib/x86_64-linux-gnu/libc.so.6+0x4300a) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
  | #5 0x7f5714e1e858  (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
  | #6 0x56b2b65951b5  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xce1b5)
  | #7 0x56b2b68c83f8  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x4013f8)
  | #8 0x56b2b6877a12  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b0a12)
  | #9 0x56b2b6879525  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b2525)
  | #10 0x56b2b687950f  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b250f)
  | #11 0x56b2b671aa0b  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x253a0b)
  | #12 0x56b2b671e92c  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x25792c)
  | #13 0x56b2b6717ea4  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x250ea4)
  | #14 0x56b2b65b4e3d  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xede3d)
  | #15 0x56b2b659fbb2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xd8bb2)
  | #16 0x56b2b65a5a80  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xdea80)
  | #17 0x56b2b65d15b2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x10a5b2)
  | #18 0x7f5714e20082  (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
  | #19 0x56b2b6598c9d  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xd1c9d)

</div></div></crash-stacktrace>[Environment] ASAN_OPTIONS=exitcode=77
+----------------------------------------Release Build Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-78f1521aec9e55e8f6602fe4083903864a79c929
Time ran: 0.043917179107666016
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3457822186
INFO: Loaded 1 modules   (18237 inline 8-bit counters): 18237 [0x56b2b69af0a0, 0x56b2b69b37dd),
INFO: Loaded 1 PC tables (18237 PCs): 18237 [0x56b2b69b37e0,0x56b2b69fabb0),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-78f1521aec9e55e8f6602fe4083903864a79c929
libc++abi: terminating due to uncaught exception of type Poco::InvalidArgumentException: Invalid argument
==248== ERROR: libFuzzer: deadly signal
    #0 0x56b2b66dee61 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
    #1 0x56b2b65d0c08 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5
    #2 0x56b2b65b3755 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:231:3
    #3 0x7f571519a41f in libpthread.so.0
    #4 0x7f5714e3f00a in __libc_signal_restore_set /build/glibc-B3wQXB/glibc-2.31/sysdeps/unix/sysv/linux/internal-signals.h:86:3
    #5 0x7f5714e3f00a in raise /build/glibc-B3wQXB/glibc-2.31/sysdeps/unix/sysv/linux/raise.c:48:3
    #6 0x7f5714e1e858 in abort /build/glibc-B3wQXB/glibc-2.31/stdlib/abort.c:79:7
    #7 0x56b2b65951b5 in __abort_message
    #8 0x56b2b68c83f8 in demangling_terminate_handler() cxa_default_handlers.cpp:0
    #9 0x56b2b6877a12 in std::__terminate(void (*)())
    #10 0x56b2b6879525 in __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) cxa_exception.cpp:0
    #11 0x56b2b687950f in __cxa_throw
    #12 0x56b2b671aa0b in Poco::DateTime::checkValid() [poco/Foundation/src/DateTime.cpp:216](https://github.com/pocoproject/poco/blob/2059accd6829606c8c3267e8701823b2bb1a61cf/Foundation/src/DateTime.cpp#L216):3
    #13 0x56b2b671e92c in Poco::DateTime::operator+=(Poco::Timespan const&) [poco/Foundation/src/DateTime.cpp:292](https://github.com/pocoproject/poco/blob/2059accd6829606c8c3267e8701823b2bb1a61cf/Foundation/src/DateTime.cpp#L292):2
    #14 0x56b2b671e92c in Poco::DateTime::makeLocal(int) [poco/Foundation/src/DateTime.cpp:337](https://github.com/pocoproject/poco/blob/2059accd6829606c8c3267e8701823b2bb1a61cf/Foundation/src/DateTime.cpp#L337):2
    #15 0x56b2b6717ea4 in LLVMFuzzerTestOneInput [poco/Foundation/fuzzing/DateTimeParse.cpp:34](https://github.com/pocoproject/poco/blob/2059accd6829606c8c3267e8701823b2bb1a61cf/Foundation/fuzzing/DateTimeParse.cpp#L34):5
    #16 0x56b2b65b4e3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #17 0x56b2b659fbb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #18 0x56b2b65a5a80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #19 0x56b2b65d15b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #20 0x7f5714e20082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
    #21 0x56b2b6598c9d in _start
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+
libc++abi: terminating due to uncaught exception of type Poco::InvalidArgumentException: Invalid argument
==248== ERROR: libFuzzer: deadly signal
    #0 0x56b2b66dee61  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x217e61)
    #1 0x56b2b65d0c08  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x109c08)
    #2 0x56b2b65b3755  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xec755)
    #3 0x7f571519a41f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078)
    #4 0x7f5714e3f00a  (/lib/x86_64-linux-gnu/libc.so.6+0x4300a) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #5 0x7f5714e1e858  (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #6 0x56b2b65951b5  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xce1b5)
    #7 0x56b2b68c83f8  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x4013f8)
    #8 0x56b2b6877a12  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b0a12)
    #9 0x56b2b6879525  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b2525)
    #10 0x56b2b687950f  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b250f)
    #11 0x56b2b671aa0b  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x253a0b)
    #12 0x56b2b671e92c  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x25792c)
    #13 0x56b2b6717ea4  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x250ea4)
    #14 0x56b2b65b4e3d  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xede3d)
    #15 0x56b2b659fbb2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xd8bb2)
    #16 0x56b2b65a5a80  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xdea80)
    #17 0x56b2b65d15b2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x10a5b2)
    #18 0x7f5714e20082  (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #19 0x56b2b6598c9d  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xd1c9d)
ORIGINAL STACKTRACE ON REVISION 1850DC16AABF5980A490BB1B66086D6695ABB823 (63 LINES)
[Environment] ASAN_OPTIONS=exitcode=77
+----------------------------------------Release Build Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/2cde0eb8ab3eed0aa7ae0533aa6f7d60ec9e55e8f6602fe4083903864a79c929
Time ran: 0.0463557243347168
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3246499650
INFO: Loaded 1 modules   (18446 inline 8-bit counters): 18446 [0x589bc8ceb0a0, 0x589bc8cef8ae),
INFO: Loaded 1 PC tables (18446 PCs): 18446 [0x589bc8cef8b0,0x589bc8d37990),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/2cde0eb8ab3eed0aa7ae0533aa6f7d60ec9e55e8f6602fe4083903864a79c929
libc++abi: terminating due to uncaught exception of type Poco::InvalidArgumentException: Invalid argument
AddressSanitizer:DEADLYSIGNAL
=================================================================
==984==ERROR: AddressSanitizer: ABRT on unknown address 0x0539000003d8 (pc 0x7fb94d9da00b bp 0x7ffe753bb3b0 sp 0x7ffe753baef0 T0)
    #0 0x7fb94d9da00b in raise /build/glibc-B3wQXB/glibc-2.31/sysdeps/unix/sysv/linux/raise.c:51:1
    #1 0x7fb94d9b9858 in abort /build/glibc-B3wQXB/glibc-2.31/stdlib/abort.c:79:7
    #2 0x589bc88cf1b5 in __abort_message
    #3 0x589bc8c051b8 in demangling_terminate_handler() cxa_default_handlers.cpp:0
    #4 0x589bc8bb47d2 in std::__terminate(void (*)())
    #5 0x589bc8bb62e5 in __cxxabiv1::failed_throw(__cxxabiv1::__cxa_exception*) cxa_exception.cpp:0
    #6 0x589bc8bb62cf in __cxa_throw
    #7 0x589bc8a54b2b in Poco::DateTime::checkValid() [poco/Foundation/src/DateTime.cpp:216](https://github.com/pocoproject/poco/blob/1850dc16aabf5980a490bb1b66086d6695abb823/Foundation/src/DateTime.cpp#L216):3
    #8 0x589bc8a58a4c in Poco::DateTime::operator+=(Poco::Timespan const&) [poco/Foundation/src/DateTime.cpp:292](https://github.com/pocoproject/poco/blob/1850dc16aabf5980a490bb1b66086d6695abb823/Foundation/src/DateTime.cpp#L292):2
    #9 0x589bc8a58a4c in Poco::DateTime::makeLocal(int) [poco/Foundation/src/DateTime.cpp:337](https://github.com/pocoproject/poco/blob/1850dc16aabf5980a490bb1b66086d6695abb823/Foundation/src/DateTime.cpp#L337):2
    #10 0x589bc8a51fc4 in LLVMFuzzerTestOneInput [poco/Foundation/fuzzing/DateTimeParse.cpp:34](https://github.com/pocoproject/poco/blob/1850dc16aabf5980a490bb1b66086d6695abb823/Foundation/fuzzing/DateTimeParse.cpp#L34):5
    #11 0x589bc88eef5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #12 0x589bc88d9cd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #13 0x589bc88dfba0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #14 0x589bc890b6d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #15 0x7fb94d9bb082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
    #16 0x589bc88d2dbd in _start
==984==Register values:
rax = 0x0000000000000000  rbx = 0x00007fb94d994780  rcx = 0x00007fb94d9da00b  rdx = 0x0000000000000000
rdi = 0x0000000000000002  rsi = 0x00007ffe753baef0  rbp = 0x00007ffe753bb3b0  rsp = 0x00007ffe753baef0
 r8 = 0x0000000000000000   r9 = 0x00007ffe753baef0  r10 = 0x0000000000000008  r11 = 0x0000000000000246
r12 = 0x0000000000000001  r13 = 0x0000000000002710  r14 = 0x00007fb94db84780  r15 = 0x0000589bc8c27e00
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x4300b) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
==984==ABORTING
+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+
=================================================================
==984==ERROR: AddressSanitizer: ABRT on unknown address 0x0539000003d8 (pc 0x7fb94d9da00b bp 0x7ffe753bb3b0 sp 0x7ffe753baef0 T0)
    #0 0x7fb94d9da00b  (/lib/x86_64-linux-gnu/libc.so.6+0x4300b) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #1 0x7fb94d9b9858  (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #2 0x589bc88cf1b5  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xcf1b5)
    #3 0x589bc8c051b8  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x4051b8)
    #4 0x589bc8bb47d2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b47d2)
    #5 0x589bc8bb62e5  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b62e5)
    #6 0x589bc8bb62cf  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x3b62cf)
    #7 0x589bc8a54b2b  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x254b2b)
    #8 0x589bc8a58a4c  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x258a4c)
    #9 0x589bc8a51fc4  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x251fc4)
    #10 0x589bc88eef5d  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xeef5d)
    #11 0x589bc88d9cd2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xd9cd2)
    #12 0x589bc88dfba0  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xdfba0)
    #13 0x589bc890b6d2  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0x10b6d2)
    #14 0x7fb94d9bb082  (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #15 0x589bc88d2dbd  (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_poco_1db3fa9809868c4ff79e01d98ba23512768546d9/revisions/date_time_fuzzer+0xd2dbd)

[matejk]

Root Cause Analysis

The minimized test case is the string 99991231 154611+1108 (20 bytes).

The fuzzer harness (Foundation/fuzzing/DateTimeParse.cpp) tries parsing this against 11 format strings. The ISO8601 format (%Y-%m-%dT%H:%M:%S%z) matches leniently (the - and T literals in the format don't match the input but are skipped in lenient mode), producing:

• DateTime: 9999-12-31T15:46:11 — valid
• tzd: 40080 seconds (= +11h08m, from +1108) — valid

Both values are individually valid. However, on line 34 the harness calls dt.makeLocal(tzd) outside any try-catch block. makeLocal adds the timezone offset (11h08m) to 9999-12-31T15:46:11, which pushes the date to 10000-01-01T02:54:11. Year 10000 exceeds the valid range (max 9999), so DateTime::checkValid() throws Poco::InvalidArgumentException, which is uncaught and causes the abort.

Proposed Fix

The library behavior is correct — makeLocal/makeUTC should throw when the result is out of range. The fix is in the fuzzer harness: wrap lines 34–35 in try-catch, consistent with the existing pattern on line 37:

try { dt.makeLocal(tzd); } catch (const std::exception&) {}
try { dt.makeUTC(tzd); } catch (const std::exception&) {}