Fix out of range panics in DateTime getters and setters

src/datetime/mod.rs

@@ -22,7 +22,7 @@ use crate::format::{
     StrftimeItems, TOO_LONG,
 };
 #[cfg(feature = "alloc")]
-use crate::format::{write_rfc3339, DelayedFormat};
+use crate::format::{write_rfc2822, write_rfc3339, DelayedFormat};
 use crate::naive::{Days, IsoWeek, NaiveDate, NaiveDateTime, NaiveTime};
 #[cfg(feature = "clock")]
 use crate::offset::Local;
@@ -505,7 +505,20 @@ impl<Tz: TimeZone> DateTime<Tz> {
     #[inline]
     #[must_use]
     pub fn naive_local(&self) -> NaiveDateTime {
-        self.datetime + self.offset.fix()
+        self.datetime
+            .checked_add_offset(self.offset.fix())
+            .expect("Local time out of range for `NaiveDateTime`")
+    }
+
+    /// Returns the naive local datetime.
+    ///
+    /// This makes use of the buffer space outside of the representable range of values of
+    /// `NaiveDateTime`. The result can be used as intermediate value, but should never be exposed
+    /// outside chrono.
+    #[inline]
+    #[must_use]
+    pub(crate) fn overflowing_naive_local(&self) -> NaiveDateTime {
+        self.datetime.overflowing_add_offset(self.offset.fix())
     }
 
     /// Retrieve the elapsed years from now to the given [`DateTime`].
@@ -540,7 +553,7 @@ impl<Tz: TimeZone> DateTime<Tz> {
     #[must_use]
     pub fn to_rfc2822(&self) -> String {
         let mut result = String::with_capacity(32);
-        crate::format::write_rfc2822(&mut result, self.naive_local(), self.offset.fix())
+        write_rfc2822(&mut result, self.overflowing_naive_local(), self.offset.fix())
             .expect("writing rfc2822 datetime to string should never fail");
         result
     }
@@ -551,7 +564,7 @@ impl<Tz: TimeZone> DateTime<Tz> {
     pub fn to_rfc3339(&self) -> String {
         // For some reason a string with a capacity less than 32 is ca 20% slower when benchmarking.
         let mut result = String::with_capacity(32);
-        let naive = self.naive_local();
+        let naive = self.overflowing_naive_local();
         let offset = self.offset.fix();
         write_rfc3339(&mut result, naive, offset, SecondsFormat::AutoSi, false)
             .expect("writing rfc3339 datetime to string should never fail");
@@ -729,7 +742,9 @@ fn map_local<Tz: TimeZone, F>(dt: &DateTime<Tz>, mut f: F) -> Option<DateTime<Tz
 where
     F: FnMut(NaiveDateTime) -> Option<NaiveDateTime>,
 {
-    f(dt.naive_local()).and_then(|datetime| dt.timezone().from_local_datetime(&datetime).single())
+    f(dt.overflowing_naive_local())
+        .and_then(|datetime| dt.timezone().from_local_datetime(&datetime).single())
+        .filter(|dt| dt >= &DateTime::<Utc>::MIN_UTC && dt <= &DateTime::<Utc>::MAX_UTC)
 }
 
 impl DateTime<FixedOffset> {
@@ -867,7 +882,7 @@ where
         I: Iterator<Item = B> + Clone,
         B: Borrow<Item<'a>>,
     {
-        let local = self.naive_local();
+        let local = self.overflowing_naive_local();
         DelayedFormat::new_with_offset(Some(local.date()), Some(local.time()), &self.offset, items)
     }
 
@@ -903,7 +918,7 @@ where
         I: Iterator<Item = B> + Clone,
         B: Borrow<Item<'a>>,
     {
-        let local = self.naive_local();
+        let local = self.overflowing_naive_local();
         DelayedFormat::new_with_offset_and_locale(
             Some(local.date()),
             Some(local.time()),
@@ -933,39 +948,39 @@ where
 impl<Tz: TimeZone> Datelike for DateTime<Tz> {
     #[inline]
     fn year(&self) -> i32 {
-        self.naive_local().year()
+        self.overflowing_naive_local().year()
     }
     #[inline]
     fn month(&self) -> u32 {
-        self.naive_local().month()
+        self.overflowing_naive_local().month()
     }
     #[inline]
     fn month0(&self) -> u32 {
-        self.naive_local().month0()
+        self.overflowing_naive_local().month0()
     }
     #[inline]
     fn day(&self) -> u32 {
-        self.naive_local().day()
+        self.overflowing_naive_local().day()
     }
     #[inline]
     fn day0(&self) -> u32 {
-        self.naive_local().day0()
+        self.overflowing_naive_local().day0()
     }
     #[inline]
     fn ordinal(&self) -> u32 {
-        self.naive_local().ordinal()
+        self.overflowing_naive_local().ordinal()
     }
     #[inline]
     fn ordinal0(&self) -> u32 {
-        self.naive_local().ordinal0()
+        self.overflowing_naive_local().ordinal0()
     }
     #[inline]
     fn weekday(&self) -> Weekday {
-        self.naive_local().weekday()
+        self.overflowing_naive_local().weekday()
     }
     #[inline]
     fn iso_week(&self) -> IsoWeek {
-        self.naive_local().iso_week()
+        self.overflowing_naive_local().iso_week()
     }
 
     #[inline]
@@ -1084,19 +1099,19 @@ impl<Tz: TimeZone> Datelike for DateTime<Tz> {
 impl<Tz: TimeZone> Timelike for DateTime<Tz> {
     #[inline]
     fn hour(&self) -> u32 {
-        self.naive_local().hour()
+        self.overflowing_naive_local().hour()
     }
     #[inline]
     fn minute(&self) -> u32 {
-        self.naive_local().minute()
+        self.overflowing_naive_local().minute()
     }
     #[inline]
     fn second(&self) -> u32 {
-        self.naive_local().second()
+        self.overflowing_naive_local().second()
     }
     #[inline]
     fn nanosecond(&self) -> u32 {
-        self.naive_local().nanosecond()
+        self.overflowing_naive_local().nanosecond()
     }
 
     /// Makes a new `DateTime` with the hour number changed.
@@ -1500,7 +1515,7 @@ impl<Tz: TimeZone> Sub<Days> for DateTime<Tz> {
 
 impl<Tz: TimeZone> fmt::Debug for DateTime<Tz> {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        self.naive_local().fmt(f)?;
+        self.overflowing_naive_local().fmt(f)?;
         self.offset.fmt(f)
     }
 }
@@ -1510,7 +1525,7 @@ where
     Tz::Offset: fmt::Display,
 {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        self.naive_local().fmt(f)?;
+        self.overflowing_naive_local().fmt(f)?;
         f.write_char(' ')?;
         self.offset.fmt(f)
     }

src/datetime/tests.rs

@@ -4,7 +4,7 @@ use crate::naive::{NaiveDate, NaiveTime};
 use crate::offset::{FixedOffset, TimeZone, Utc};
 #[cfg(feature = "clock")]
 use crate::offset::{Local, Offset};
-use crate::{Datelike, Days, LocalResult, Months, NaiveDateTime, Timelike};
+use crate::{Datelike, Days, LocalResult, Months, NaiveDateTime, Timelike, Weekday};
 
 #[derive(Clone)]
 struct DstTester;
@@ -1331,6 +1331,126 @@ fn test_datetime_sub_assign() {
     assert_eq!(datetime_sub, datetime - OldDuration::minutes(90));
 }
 
+#[test]
+fn test_min_max_getters() {
+    let offset_min = FixedOffset::west_opt(2 * 60 * 60).unwrap();
+    let beyond_min = offset_min.from_utc_datetime(&NaiveDateTime::MIN);
+    let offset_max = FixedOffset::east_opt(2 * 60 * 60).unwrap();
+    let beyond_max = offset_max.from_utc_datetime(&NaiveDateTime::MAX);
+
+    assert_eq!(format!("{:?}", beyond_min), "-262144-12-31T22:00:00-02:00");
+    // RFC 2822 doesn't support years with more than 4 digits.
+    // assert_eq!(beyond_min.to_rfc2822(), "");
+    #[cfg(any(feature = "alloc", feature = "std"))]
+    assert_eq!(beyond_min.to_rfc3339(), "-262144-12-31T22:00:00-02:00");
+    #[cfg(any(feature = "alloc", feature = "std"))]
+    assert_eq!(
+        beyond_min.format("%Y-%m-%dT%H:%M:%S%:z").to_string(),
+        "-262144-12-31T22:00:00-02:00"
+    );
+    assert_eq!(beyond_min.year(), -262144);
+    assert_eq!(beyond_min.month(), 12);
+    assert_eq!(beyond_min.month0(), 11);
+    assert_eq!(beyond_min.day(), 31);
+    assert_eq!(beyond_min.day0(), 30);
+    assert_eq!(beyond_min.ordinal(), 366);
+    assert_eq!(beyond_min.ordinal0(), 365);
+    assert_eq!(beyond_min.weekday(), Weekday::Wed);
+    assert_eq!(beyond_min.iso_week().year(), -262143);
+    assert_eq!(beyond_min.iso_week().week(), 1);
+    assert_eq!(beyond_min.hour(), 22);
+    assert_eq!(beyond_min.minute(), 0);
+    assert_eq!(beyond_min.second(), 0);
+    assert_eq!(beyond_min.nanosecond(), 0);
+
+    assert_eq!(format!("{:?}", beyond_max), "+262143-01-01T01:59:59.999999999+02:00");
+    // RFC 2822 doesn't support years with more than 4 digits.
+    // assert_eq!(beyond_max.to_rfc2822(), "");
+    #[cfg(any(feature = "alloc", feature = "std"))]
+    assert_eq!(beyond_max.to_rfc3339(), "+262143-01-01T01:59:59.999999999+02:00");
+    #[cfg(any(feature = "alloc", feature = "std"))]
+    assert_eq!(
+        beyond_max.format("%Y-%m-%dT%H:%M:%S%.9f%:z").to_string(),
+        "+262143-01-01T01:59:59.999999999+02:00"
+    );
+    assert_eq!(beyond_max.year(), 262143);
+    assert_eq!(beyond_max.month(), 1);
+    assert_eq!(beyond_max.month0(), 0);
+    assert_eq!(beyond_max.day(), 1);
+    assert_eq!(beyond_max.day0(), 0);
+    assert_eq!(beyond_max.ordinal(), 1);
+    assert_eq!(beyond_max.ordinal0(), 0);
+    assert_eq!(beyond_max.weekday(), Weekday::Tue);
+    assert_eq!(beyond_max.iso_week().year(), 262143);
+    assert_eq!(beyond_max.iso_week().week(), 1);
+    assert_eq!(beyond_max.hour(), 1);
+    assert_eq!(beyond_max.minute(), 59);
+    assert_eq!(beyond_max.second(), 59);
+    assert_eq!(beyond_max.nanosecond(), 999_999_999);
+}
+
+#[test]
+fn test_min_max_setters() {
+    let offset_min = FixedOffset::west_opt(2 * 60 * 60).unwrap();
+    let beyond_min = offset_min.from_utc_datetime(&NaiveDateTime::MIN);
+    let offset_max = FixedOffset::east_opt(2 * 60 * 60).unwrap();
+    let beyond_max = offset_max.from_utc_datetime(&NaiveDateTime::MAX);
+
+    assert_eq!(beyond_min.with_year(2020).unwrap().year(), 2020);
+    assert_eq!(beyond_min.with_month(beyond_min.month()), Some(beyond_min));
+    assert_eq!(beyond_min.with_month(3), None);
+    assert_eq!(beyond_min.with_month0(beyond_min.month0()), Some(beyond_min));
+    assert_eq!(beyond_min.with_month0(3), None);
+    assert_eq!(beyond_min.with_day(beyond_min.day()), Some(beyond_min));
+    assert_eq!(beyond_min.with_day(15), None);
+    assert_eq!(beyond_min.with_day0(beyond_min.day0()), Some(beyond_min));
+    assert_eq!(beyond_min.with_day0(15), None);
+    assert_eq!(beyond_min.with_ordinal(beyond_min.ordinal()), Some(beyond_min));
+    assert_eq!(beyond_min.with_ordinal(200), None);
+    assert_eq!(beyond_min.with_ordinal0(beyond_min.ordinal0()), Some(beyond_min));
+    assert_eq!(beyond_min.with_ordinal0(200), None);
+    assert_eq!(beyond_min.with_hour(beyond_min.hour()), Some(beyond_min));
+    assert_eq!(beyond_min.with_hour(23), beyond_min.checked_add_signed(OldDuration::hours(1)));
+    assert_eq!(beyond_min.with_hour(5), None);
+    assert_eq!(beyond_min.with_minute(0), Some(beyond_min));
+    assert_eq!(beyond_min.with_second(0), Some(beyond_min));
+    assert_eq!(beyond_min.with_nanosecond(0), Some(beyond_min));
+
+    assert_eq!(beyond_max.with_year(2020).unwrap().year(), 2020);
+    assert_eq!(beyond_max.with_month(beyond_max.month()), Some(beyond_max));
+    assert_eq!(beyond_max.with_month(3), None);
+    assert_eq!(beyond_max.with_month0(beyond_max.month0()), Some(beyond_max));
+    assert_eq!(beyond_max.with_month0(3), None);
+    assert_eq!(beyond_max.with_day(beyond_max.day()), Some(beyond_max));
+    assert_eq!(beyond_max.with_day(15), None);
+    assert_eq!(beyond_max.with_day0(beyond_max.day0()), Some(beyond_max));
+    assert_eq!(beyond_max.with_day0(15), None);
+    assert_eq!(beyond_max.with_ordinal(beyond_max.ordinal()), Some(beyond_max));
+    assert_eq!(beyond_max.with_ordinal(200), None);
+    assert_eq!(beyond_max.with_ordinal0(beyond_max.ordinal0()), Some(beyond_max));
+    assert_eq!(beyond_max.with_ordinal0(200), None);
+    assert_eq!(beyond_max.with_hour(beyond_max.hour()), Some(beyond_max));
+    assert_eq!(beyond_max.with_hour(0), beyond_max.checked_sub_signed(OldDuration::hours(1)));
+    assert_eq!(beyond_max.with_hour(5), None);
+    assert_eq!(beyond_max.with_minute(beyond_max.minute()), Some(beyond_max));
+    assert_eq!(beyond_max.with_second(beyond_max.second()), Some(beyond_max));
+    assert_eq!(beyond_max.with_nanosecond(beyond_max.nanosecond()), Some(beyond_max));
+}
+
+#[test]
+#[should_panic]
+fn test_local_beyond_min_datetime() {
+    let min = FixedOffset::west_opt(2 * 60 * 60).unwrap().from_utc_datetime(&NaiveDateTime::MIN);
+    let _ = min.naive_local();
+}
+
+#[test]
+#[should_panic]
+fn test_local_beyond_max_datetime() {
+    let max = FixedOffset::east_opt(2 * 60 * 60).unwrap().from_utc_datetime(&NaiveDateTime::MAX);
+    let _ = max.naive_local();
+}
+
 #[test]
 #[cfg(feature = "clock")]
 fn test_datetime_sub_assign_local() {