Reject out-of-range UTC offsets in the pure-Python parsers

Author: Sharadhi-v98

src/pendulum/formatting/formatter.py

@@ -607,6 +607,9 @@ def _get_parsed_value(
 
             offset = ((int(off_hour) * 60) + int(off_minute)) * 60
 
+            if abs(offset) >= 24 * 3600:
+                raise ValueError("Invalid date")
+
             if negative:
                 offset = -1 * offset
 

src/pendulum/parsing/iso8601.py

@@ -250,6 +250,9 @@ def parse_iso8601(
 
             offset = ((int(off_hour) * 60) + int(off_minute)) * 60
 
+            if abs(offset) >= 24 * 3600:
+                raise ParserError(f"Invalid date string: {text}")
+
             if negative:
                 offset = -1 * offset
 

tests/datetime/test_from_format.py

@@ -72,6 +72,13 @@ def test_from_format_with_invalid_padded_day():
         pendulum.from_format("Apr   2 12:00:00 2020 GMT", "MMM DD HH:mm:ss YYYY z")
 
 
+def test_from_format_with_out_of_range_offset():
+    with pytest.raises(ValueError):
+        pendulum.from_format("1975-05-21 22:32:11 +9959", "YYYY-MM-DD HH:mm:ss ZZ")
+    with pytest.raises(ValueError):
+        pendulum.from_format("1975-05-21 22:32:11 +24:00", "YYYY-MM-DD HH:mm:ss Z")
+
+
 @pytest.mark.parametrize(
     "text,fmt,expected,now",
     [

tests/parsing/test_parse_iso8601.py

@@ -153,6 +153,14 @@ def test_parse_iso8601_invalid():
     with pytest.raises(ValueError):
         parse_iso8601("2009-05-19 14:39:22+0:6:00")
 
+    # Offset out of range (>= 24h)
+    with pytest.raises(ValueError):
+        parse_iso8601("2016-10-16T12:34:56+99:59")
+    with pytest.raises(ValueError):
+        parse_iso8601("2016-10-16T12:34:56-2400")
+    with pytest.raises(ValueError):
+        parse_iso8601("2016-10-16T12:34:56+2400")
+
     # Missing time separator
     with pytest.raises(ValueError):
         parse_iso8601("2009-05-1914:39")