Validate GRIB reference timestamps

Author: i-norden

grib-core/src/grib1.rs

@@ -51,7 +51,7 @@ impl ProductDefinition {
             parameter_number: section_bytes[8],
             level_type: section_bytes[9],
             level_value: u16::from_be_bytes(section_bytes[10..12].try_into().unwrap()),
-            reference_time: parse_reference_time(section_bytes),
+            reference_time: parse_reference_time(section_bytes)?,
             forecast_time_unit: section_bytes[17],
             p1: section_bytes[18],
             p2: section_bytes[19],
@@ -179,22 +179,24 @@ impl BinaryDataSection {
     }
 }
 
-fn parse_reference_time(section_bytes: &[u8]) -> ReferenceTime {
+fn parse_reference_time(section_bytes: &[u8]) -> Result<ReferenceTime> {
     let century = section_bytes[24];
     let year_of_century = u16::from(section_bytes[12]);
     let year = match century {
         0 => year_of_century,
         c => (u16::from(c) - 1) * 100 + year_of_century,
     };
 
-    ReferenceTime {
+    let reference_time = ReferenceTime {
         year,
         month: section_bytes[13],
         day: section_bytes[14],
         hour: section_bytes[15],
         minute: section_bytes[16],
         second: 0,
-    }
+    };
+    reference_time.validate_in_section(1)?;
+    Ok(reference_time)
 }
 
 fn parse_latlon_grid(section_bytes: &[u8]) -> GridDefinition {
@@ -228,6 +230,7 @@ fn parse_latlon_grid(section_bytes: &[u8]) -> GridDefinition {
 #[cfg(test)]
 mod tests {
     use super::ProductDefinition;
+    use crate::error::Error;
     use crate::metadata::ReferenceTime;
 
     #[test]
@@ -263,4 +266,49 @@ mod tests {
 
         assert_eq!(product.forecast_time(), Some(300));
     }
+
+    #[test]
+    fn rejects_invalid_product_definition_reference_time() {
+        let mut section = valid_product_definition_section();
+        section[13] = 2;
+        section[14] = 29;
+        let err = ProductDefinition::parse(&section).unwrap_err();
+        assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+        assert!(err.to_string().contains("invalid reference timestamp"));
+
+        let mut section = valid_product_definition_section();
+        section[15] = 24;
+        let err = ProductDefinition::parse(&section).unwrap_err();
+        assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+
+        let mut section = valid_product_definition_section();
+        section[16] = 60;
+        let err = ProductDefinition::parse(&section).unwrap_err();
+        assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+    }
+
+    fn valid_product_definition_section() -> Vec<u8> {
+        let mut section = vec![0u8; 28];
+        section[..3].copy_from_slice(&[0, 0, 28]);
+        section[3] = 2;
+        section[4] = 7;
+        section[5] = 255;
+        section[6] = 0;
+        section[7] = 0b1000_0000;
+        section[8] = 11;
+        section[9] = 100;
+        section[10..12].copy_from_slice(&850u16.to_be_bytes());
+        section[12] = 26;
+        section[13] = 3;
+        section[14] = 20;
+        section[15] = 12;
+        section[16] = 0;
+        section[17] = 1;
+        section[18] = 0;
+        section[19] = 0;
+        section[20] = 0;
+        section[24] = 21;
+        section[25] = 0;
+        section
+    }
 }

grib-core/src/metadata.rs

@@ -1,5 +1,7 @@
 //! Edition-independent field metadata.
 
+use crate::error::{Error, Result};
+
 use std::borrow::Cow;
 
 /// Semantic forecast-time units shared across GRIB editions.
@@ -101,6 +103,25 @@ pub struct ReferenceTime {
 }
 
 impl ReferenceTime {
+    /// Return whether this timestamp has valid calendar and time-of-day fields.
+    pub fn is_valid(&self) -> bool {
+        self.seconds_since_epoch().is_some()
+    }
+
+    pub(crate) fn validate_in_section(&self, section: u8) -> Result<()> {
+        if self.is_valid() {
+            return Ok(());
+        }
+
+        Err(Error::InvalidSection {
+            section,
+            reason: format!(
+                "invalid reference timestamp {:04}-{:02}-{:02}T{:02}:{:02}:{:02}Z",
+                self.year, self.month, self.day, self.hour, self.minute, self.second
+            ),
+        })
+    }
+
     /// Add a GRIB forecast lead using a semantic forecast-time unit.
     ///
     /// Returns `None` for calendar-dependent units or invalid timestamps.
@@ -390,6 +411,47 @@ mod tests {
         .is_none());
     }
 
+    #[test]
+    fn validates_calendar_and_time_ranges() {
+        assert!(ReferenceTime {
+            year: 2024,
+            month: 2,
+            day: 29,
+            hour: 23,
+            minute: 59,
+            second: 59,
+        }
+        .is_valid());
+
+        assert!(!ReferenceTime {
+            year: 2026,
+            month: 2,
+            day: 29,
+            hour: 12,
+            minute: 0,
+            second: 0,
+        }
+        .is_valid());
+        assert!(!ReferenceTime {
+            year: 2026,
+            month: 13,
+            day: 1,
+            hour: 0,
+            minute: 0,
+            second: 0,
+        }
+        .is_valid());
+        assert!(!ReferenceTime {
+            year: 2026,
+            month: 3,
+            day: 20,
+            hour: 24,
+            minute: 0,
+            second: 0,
+        }
+        .is_valid());
+    }
+
     #[test]
     fn decodes_edition_specific_forecast_units() {
         assert_eq!(

grib-core/src/product.rs

@@ -1,6 +1,7 @@
 //! GRIB2 metadata carried by Sections 1 and 4.
 
 use crate::error::{Error, Result};
+use crate::metadata::ReferenceTime;
 use crate::parameter;
 use crate::util::{grib_i32, grib_i8};
 
@@ -37,18 +38,28 @@ impl Identification {
             });
         }
 
+        let reference_time = ReferenceTime {
+            year: u16::from_be_bytes(section_bytes[12..14].try_into().unwrap()),
+            month: section_bytes[14],
+            day: section_bytes[15],
+            hour: section_bytes[16],
+            minute: section_bytes[17],
+            second: section_bytes[18],
+        };
+        reference_time.validate_in_section(1)?;
+
         Ok(Self {
             center_id: u16::from_be_bytes(section_bytes[5..7].try_into().unwrap()),
             subcenter_id: u16::from_be_bytes(section_bytes[7..9].try_into().unwrap()),
             master_table_version: section_bytes[9],
             local_table_version: section_bytes[10],
             significance_of_reference_time: section_bytes[11],
-            reference_year: u16::from_be_bytes(section_bytes[12..14].try_into().unwrap()),
-            reference_month: section_bytes[14],
-            reference_day: section_bytes[15],
-            reference_hour: section_bytes[16],
-            reference_minute: section_bytes[17],
-            reference_second: section_bytes[18],
+            reference_year: reference_time.year,
+            reference_month: reference_time.month,
+            reference_day: reference_time.day,
+            reference_hour: reference_time.hour,
+            reference_minute: reference_time.minute,
+            reference_second: reference_time.second,
             production_status: section_bytes[19],
             processed_data_type: section_bytes[20],
         })
@@ -239,29 +250,29 @@ mod tests {
 
     #[test]
     fn parses_identification_section() {
-        let mut section = vec![0u8; 21];
-        section[..4].copy_from_slice(&(21u32).to_be_bytes());
-        section[4] = 1;
-        section[5..7].copy_from_slice(&7u16.to_be_bytes());
-        section[7..9].copy_from_slice(&14u16.to_be_bytes());
-        section[9] = 35;
-        section[10] = 1;
-        section[11] = 1;
-        section[12..14].copy_from_slice(&2026u16.to_be_bytes());
-        section[14] = 3;
-        section[15] = 20;
-        section[16] = 12;
-        section[17] = 30;
-        section[18] = 45;
-        section[19] = 0;
-        section[20] = 1;
+        let section = valid_identification_section();
 
         let id = Identification::parse(&section).unwrap();
         assert_eq!(id.center_id, 7);
         assert_eq!(id.reference_year, 2026);
         assert_eq!(id.reference_hour, 12);
     }
 
+    #[test]
+    fn rejects_invalid_identification_reference_time() {
+        let mut section = valid_identification_section();
+        section[14] = 2;
+        section[15] = 29;
+        let err = Identification::parse(&section).unwrap_err();
+        assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+        assert!(err.to_string().contains("invalid reference timestamp"));
+
+        let mut section = valid_identification_section();
+        section[18] = 60;
+        let err = Identification::parse(&section).unwrap_err();
+        assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+    }
+
     #[test]
     fn parses_product_definition_template_zero_fields() {
         let mut section = vec![0u8; 34];
@@ -321,4 +332,24 @@ mod tests {
         let err = ProductDefinition::parse(&section).unwrap_err();
         assert!(matches!(err, Error::InvalidSection { section: 4, .. }));
     }
+
+    fn valid_identification_section() -> Vec<u8> {
+        let mut section = vec![0u8; 21];
+        section[..4].copy_from_slice(&(21u32).to_be_bytes());
+        section[4] = 1;
+        section[5..7].copy_from_slice(&7u16.to_be_bytes());
+        section[7..9].copy_from_slice(&14u16.to_be_bytes());
+        section[9] = 35;
+        section[10] = 1;
+        section[11] = 1;
+        section[12..14].copy_from_slice(&2026u16.to_be_bytes());
+        section[14] = 3;
+        section[15] = 20;
+        section[16] = 12;
+        section[17] = 30;
+        section[18] = 45;
+        section[19] = 0;
+        section[20] = 1;
+        section
+    }
 }

grib-reader/src/grib1.rs

@@ -149,6 +149,10 @@ mod tests {
         let mut pds = vec![0u8; 28];
         pds[..3].copy_from_slice(&[0, 0, 28]);
         pds[7] = 0b1000_0000;
+        pds[12] = 26;
+        pds[13] = 3;
+        pds[14] = 20;
+        pds[15] = 12;
         pds[24] = 21;
         message.extend_from_slice(&pds);
         let mut gds = vec![0u8; 32];
@@ -173,6 +177,10 @@ mod tests {
         let mut pds = vec![0u8; 28];
         pds[..3].copy_from_slice(&[0, 0, 28]);
         pds[7] = 0b1000_0000;
+        pds[12] = 26;
+        pds[13] = 3;
+        pds[14] = 20;
+        pds[15] = 12;
         pds[24] = 21;
         message.extend_from_slice(&pds);
         let mut gds = vec![0u8; 32];

grib-reader/tests/corruption.rs

@@ -68,6 +68,29 @@ fn rejects_impossibly_short_reported_message_length() {
     assert!(matches!(err, Error::InvalidMessage(_)));
 }
 
+#[test]
+fn rejects_invalid_grib2_reference_timestamp() {
+    let mut message = build_grib2_message(&[1, 2, 3, 4]);
+    let section1_offset = 16;
+    message[section1_offset + 18] = 60;
+
+    let err = expect_err(message);
+    assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+    assert!(err.to_string().contains("invalid reference timestamp"));
+}
+
+#[test]
+fn rejects_invalid_grib1_reference_timestamp() {
+    let mut message = build_grib1_message(&[1, 2, 3, 4]);
+    let pds_offset = 8;
+    message[pds_offset + 13] = 2;
+    message[pds_offset + 14] = 29;
+
+    let err = expect_err(message);
+    assert!(matches!(err, Error::InvalidSection { section: 1, .. }));
+    assert!(err.to_string().contains("invalid reference timestamp"));
+}
+
 #[test]
 fn strict_open_reports_validly_framed_unsupported_edition() {
     let err = expect_err(build_valid_unsupported_edition_message(3));