Tarantool Assertion Vulnerability in DateTime Handling

A vulnerability exists in Tarantool versions through 3.3.1, specifically within the 'tm_to_datetime' function of the 'src/lib/core/datetime.c' file. This issue arises from improper input handling, leading to a reachable assertion that causes the application to terminate unexpectedly. The vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability triggers an assertion failure, causing the application to crash. This behavior disrupts normal operations and can be classified as a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by compiling Tarantool with fuzzing enabled, using Clang as the compiler. After building the application, the 'datetime_strptime_fuzzer' can be used to test the 'tm_to_datetime' function with specially crafted input that triggers the assertion failure.