Discard long durations

Author: josevalim

lib/elixir/lib/calendar/duration.ex

@@ -367,6 +367,9 @@ defmodule Duration do
 
   Only seconds may be specified with a decimal fraction, using either a comma or a full stop: `P1DT4,5S`.
 
+  Inputs longer than 192 bytes are rejected, which is enough to parse each unit as a maximum signed
+  64-bit integer (although it also allows parsing a single unit with 190 digits).
+
   ## Examples
 
       iex> Duration.from_iso8601("P1Y2M3DT4H5M6S")

lib/elixir/lib/calendar/iso.ex

@@ -706,15 +706,15 @@ defmodule Calendar.ISO do
   """
   @doc since: "1.17.0"
   @spec parse_duration(String.t()) :: {:ok, [Duration.unit_pair()]} | {:error, atom}
-  def parse_duration("P" <> string) when byte_size(string) > 0 do
+  def parse_duration("P" <> string) when byte_size(string) in 1..191 do
     parse_duration_date(string, 1, [], 0)
   end
 
-  def parse_duration("+P" <> string) when byte_size(string) > 0 do
+  def parse_duration("+P" <> string) when byte_size(string) in 1..190 do
     parse_duration_date(string, 1, [], 0)
   end
 
-  def parse_duration("-P" <> string) when byte_size(string) > 0 do
+  def parse_duration("-P" <> string) when byte_size(string) in 1..190 do
     parse_duration_date(string, -1, [], 0)
   end
 

lib/elixir/test/elixir/calendar/duration_test.exs

@@ -246,6 +246,18 @@ defmodule DurationTest do
     assert Duration.from_iso8601("PT.6S") == {:error, :invalid_time_component}
     assert Duration.from_iso8601("PT0.5H") == {:error, :invalid_time_component}
     assert Duration.from_iso8601("invalid") == {:error, :invalid_duration}
+
+    # Inputs are capped at 192 bytes
+    digits = String.duplicate("9", 189)
+    assert {:ok, %Duration{}} = Duration.from_iso8601("P9#{digits}D")
+    assert {:ok, %Duration{}} = Duration.from_iso8601("-P#{digits}D")
+    assert {:ok, %Duration{}} = Duration.from_iso8601("+P#{digits}D")
+    assert Duration.from_iso8601("P99#{digits}D") == {:error, :invalid_duration}
+    assert Duration.from_iso8601("-P9#{digits}D") == {:error, :invalid_duration}
+    assert Duration.from_iso8601("+P9#{digits}D") == {:error, :invalid_duration}
+
+    assert Duration.from_iso8601("P#{String.duplicate("9", 4_000_000)}D") ==
+             {:error, :invalid_duration}
   end
 
   test "from_iso8601!/1" do