fix offset clamp

Author: TCeason

src/common/io/src/cursor_ext/cursor_read_datetime_ext.rs

@@ -27,6 +27,7 @@ use databend_common_timezone::fast_utc_from_local;
 
 use crate::cursor_ext::cursor_read_bytes_ext::ReadBytesExt;
 use crate::datetime::check_input_year;
+use crate::datetime::check_timezone_offset;
 use crate::datetime::parse_standard_timestamp as parse_iso_timestamp;
 
 pub enum DateTimeResType {
@@ -44,9 +45,6 @@ const DATE_LEN: usize = 10;
 const MICROS_PER_SEC: i64 = 1_000_000;
 const SECONDS_PER_DAY: i64 = 86_400;
 
-// ISO 8601 maximum offset.
-const MAX_OFFSET_HOURS: i32 = 14;
-
 fn parse_time_part(buf: &[u8], size: usize) -> Result<u32> {
     if size > 0 && size < 3 {
         Ok(lexical_core::FromLexical::from_lexical(buf)
@@ -195,18 +193,15 @@ fn read_offset_seconds<T: AsRef<[u8]>>(
     west_tz: bool,
 ) -> Result<i32> {
     fn validated(hour_offset: i32, minute_offset: i32, west_tz: bool) -> Result<i32> {
-        let in_range = (hour_offset == MAX_OFFSET_HOURS && minute_offset == 0)
-            || ((0..60).contains(&minute_offset) && hour_offset < MAX_OFFSET_HOURS);
-
-        if !in_range {
-            return Err(ErrorCode::BadBytes(format!(
-                "Invalid Timezone Offset: The minute offset '{}' is outside the valid range. Expected range is [00-59] within a timezone gap of [-14:00, +14:00]",
-                minute_offset
-            )));
+        if !(0..60).contains(&minute_offset) {
+            return Err(ErrorCode::InvalidTimezone(
+                "Timezone offset minute must be in [00, 59]",
+            ));
         }
-
         let seconds = hour_offset * 3600 + minute_offset * 60;
-        Ok(if west_tz { -seconds } else { seconds })
+        let offset = if west_tz { -seconds } else { seconds };
+        check_timezone_offset(offset)?;
+        Ok(offset)
     }
 
     let n = cursor.keep_read(buf, |f| f.is_ascii_digit());
@@ -216,12 +211,6 @@ fn read_offset_seconds<T: AsRef<[u8]>>(
                 .map_err_to_code(ErrorCode::BadBytes, || {
                     "hour offset parse error".to_string()
                 })?;
-            if !(0..=MAX_OFFSET_HOURS).contains(&hour_offset) {
-                return Err(ErrorCode::BadBytes(format!(
-                    "Invalid Timezone Offset: The hour offset '{}' is outside the valid range. Expected range is [00-14] within a timezone gap of [-14:00, +14:00]",
-                    hour_offset
-                )));
-            }
 
             buf.clear();
             if !cursor.ignore_byte(b':') {
@@ -250,12 +239,6 @@ fn read_offset_seconds<T: AsRef<[u8]>>(
                 })?;
             buf.clear();
 
-            if !(0..=MAX_OFFSET_HOURS).contains(&hour_offset) {
-                return Err(ErrorCode::BadBytes(format!(
-                    "Invalid Timezone Offset: The hour offset '{}' is outside the valid range. Expected range is [00-14] within a timezone gap of [-14:00, +14:00]",
-                    hour_offset
-                )));
-            }
             validated(hour_offset, minute_offset, west_tz)
         }
         _ => Err(ErrorCode::BadBytes(

src/common/io/src/datetime.rs

@@ -59,8 +59,8 @@ pub fn parse_four_digits(bytes: &[u8]) -> Option<i32> {
 }
 
 /// Calendar text and explicit date-part constructors keep the four-digit year
-/// contract. The wider SQL value range is headroom for arithmetic and timezone
-/// conversion, not an extension of accepted calendar input.
+/// contract. Intermediate arithmetic and timezone conversion may use wider
+/// calendar years, with the final result checked against the SQL type bounds.
 pub fn check_input_year(year: i32) -> Result<()> {
     if (1..=9999).contains(&year) {
         Ok(())
@@ -71,6 +71,20 @@ pub fn check_input_year(year: i32) -> Result<()> {
     }
 }
 
+/// Validate an explicit numeric timezone offset in seconds.
+/// This input restriction does not apply to offsets resolved from named timezones.
+#[inline]
+pub fn check_timezone_offset(offset_seconds: i32) -> Result<()> {
+    const MAX_OFFSET: i32 = 14 * 3600;
+    if (-MAX_OFFSET..=MAX_OFFSET).contains(&offset_seconds) {
+        Ok(())
+    } else {
+        Err(ErrorCode::InvalidTimezone(format!(
+            "Timezone offset {offset_seconds} seconds is out of range [-14:00, +14:00]"
+        )))
+    }
+}
+
 /// Parse ISO-8601-like timestamps: `YYYY-MM-DD HH:MM:SS[.ffffff][Z|(+|-)hh[:mm]]`.
 /// Returning `None` indicates that the input is not in the supported format.
 #[inline(always)]
@@ -188,16 +202,16 @@ pub fn parse_standard_timestamp(input: &[u8]) -> Option<Result<ParsedTimestamp>>
                     idx += 2;
                 }
 
-                if hour_offset > 14
-                    || minute_offset >= 60
-                    || (hour_offset == 14 && minute_offset != 0)
-                {
-                    return Some(Err(ErrorCode::BadBytes(
-                        "Timezone offset out of range".to_string(),
+                if minute_offset >= 60 {
+                    return Some(Err(ErrorCode::InvalidTimezone(
+                        "Timezone offset minute must be in [00, 59]",
                     )));
                 }
-
-                provided_offset = Some(sign * (hour_offset * 3600 + minute_offset * 60));
+                let offset = sign * (hour_offset * 3600 + minute_offset * 60);
+                if let Err(err) = check_timezone_offset(offset) {
+                    return Some(Err(err));
+                }
+                provided_offset = Some(offset);
             }
             _ => return None,
         }

src/query/datavalues/src/types/type_date.rs

@@ -17,8 +17,8 @@ use super::type_id::TypeID;
 use crate::prelude::*;
 
 // SQL DATE bounds, as days since 1970-01-01. Keep in sync with common-expression.
-// Out-of-range SQL values are errors, not silently replaced with another date.
-pub const DATE_MAX: i32 = 3_298_504; // 11000-12-31
+// Conversion and arithmetic paths retain their own overflow policies.
+pub const DATE_MAX: i32 = 2_932_896; // 9999-12-31
 pub const DATE_MIN: i32 = -719_162; // 0001-01-01
 
 #[derive(Default, Clone, Hash, serde::Deserialize, serde::Serialize)]

src/query/expression/src/types/date.rs

@@ -37,15 +37,12 @@ use crate::values::Column;
 use crate::values::Scalar;
 
 pub const DATE_FORMAT: &str = "%Y-%m-%d";
-/// Internal SQL DATE bounds, represented as days since 1970-01-01.
-/// Years through 11000 provide headroom for arithmetic and timezone conversion;
-/// calendar text and explicit date-part constructors still accept 0001..=9999.
-/// This keeps the UInt16 year extraction API. Computed extended dates can be
-/// displayed, but their text is not necessarily accepted as calendar input.
+/// SQL DATE bounds, represented as days since 1970-01-01.
+/// Calendar inputs and computed DATE values both use years 0001..=9999.
 /// 0001-01-01
 pub const DATE_MIN: i32 = -719_162;
-/// 11000-12-31
-pub const DATE_MAX: i32 = 3_298_504;
+/// 9999-12-31
+pub const DATE_MAX: i32 = 2_932_896;
 
 /// Converts internal epoch days. SQL inputs must pass `check_date` first.
 pub fn date_from_days(days: impl AsPrimitive<i64>) -> NaiveDate {
@@ -71,7 +68,7 @@ pub fn check_date(days: i64) -> Result<i32, String> {
     if (i64::from(DATE_MIN)..=i64::from(DATE_MAX)).contains(&days) {
         Ok(days as i32)
     } else {
-        Err("Invalid date: date is out of range [0001-01-01, 11000-12-31]".to_string())
+        Err("Invalid date: date is out of range [0001-01-01, 9999-12-31]".to_string())
     }
 }
 

src/query/expression/src/types/timestamp.rs

@@ -24,6 +24,7 @@ use databend_common_exception::ErrorCode;
 use databend_common_io::cursor_ext::BufferReadDateTimeExt;
 use databend_common_io::cursor_ext::DateTimeResType;
 use databend_common_io::cursor_ext::ReadBytesExt;
+pub use databend_common_io::datetime::check_timezone_offset;
 use num_traits::AsPrimitive;
 
 use super::ArgType;
@@ -39,23 +40,21 @@ use crate::values::Scalar;
 
 pub const TIMESTAMP_FORMAT: &str = "%Y-%m-%d %H:%M:%S%.6f";
 /// SQL TIMESTAMP and TIMESTAMP_TZ bounds, in UTC microseconds since 1970-01-01.
-/// Internal range for computed UTC instants: 0001..=11000. Calendar text and
-/// explicit date-part constructors retain 0001..=9999; chrono's wider range is
-/// not exposed as an expanded input contract.
-/// Validate the final UTC instant after timezone resolution: a valid instant may
-/// display in local year 0 or 11001. Converting that local date to SQL DATE must
-/// separately validate DATE_MIN/MAX. Conversion and arithmetic paths retain
-/// their legacy overflow policies; display conversion clamps to these bounds.
+/// Validate the final UTC instant after timezone resolution, not intermediate
+/// calendar fields. A valid instant may display in local year 0 or 10000.
+/// Converting that local date to SQL DATE must separately validate DATE_MIN/MAX.
+/// INTERVAL arithmetic reports out-of-range results; other paths retain their
+/// existing overflow policies. Display conversion clamps to these bounds.
 /// 0001-01-01 00:00:00.000000 UTC
 pub const TIMESTAMP_MIN: i64 = -62_135_596_800_000_000;
-/// 11000-12-31 23:59:59.999999 UTC
-pub const TIMESTAMP_MAX: i64 = 284_990_831_999_999_999;
+/// 9999-12-31 23:59:59.999999 UTC
+pub const TIMESTAMP_MAX: i64 = 253_402_300_799_999_999;
 
 pub const MICROS_PER_SEC: i64 = 1_000_000;
 pub const MICROS_PER_MILLI: i64 = 1_000;
 
 /// Clamp to the SQL UTC bounds before converting for display.
-/// Chrono has room for local year 0/11001 at these boundaries.
+/// Chrono has room for local year 0/10000 at these boundaries.
 pub fn timestamp_from_micros(micros: impl AsPrimitive<i64>, tz: &Tz) -> DateTime<Tz> {
     let micros = micros.as_().clamp(TIMESTAMP_MIN, TIMESTAMP_MAX);
     let seconds = micros.div_euclid(MICROS_PER_SEC);
@@ -83,7 +82,7 @@ pub fn check_timestamp(micros: i64) -> Result<i64, String> {
     if (TIMESTAMP_MIN..=TIMESTAMP_MAX).contains(&micros) {
         Ok(micros)
     } else {
-        Err("Invalid date: timestamp is out of range [0001-01-01, 11000-12-31] UTC".to_string())
+        Err("Invalid date: timestamp is out of range [0001-01-01, 9999-12-31] UTC".to_string())
     }
 }
 
@@ -214,7 +213,7 @@ pub fn string_to_timestamp(
         }
         Ok(DateTimeResType::Date(_)) => Err(ErrorCode::BadArguments("unexpected argument")),
         Err(e) => match e.code() {
-            ErrorCode::BAD_BYTES => Err(e),
+            ErrorCode::BAD_BYTES | ErrorCode::INVALID_TIMEZONE => Err(e),
             _ => Err(ErrorCode::BadArguments("unexpected argument")),
         },
     }
@@ -225,8 +224,7 @@ pub fn timestamp_to_string(ts: i64, tz: &Tz) -> impl Display {
     timestamp_from_micros(ts, tz).format(TIMESTAMP_FORMAT)
 }
 
-/// Render a microsecond-precision UTC timestamp. Years through 9999 use RFC 3339;
-/// extended years use ISO 8601's signed form (for example `+11000`).
+/// Render a microsecond-precision UTC timestamp in RFC 3339 format.
 #[inline]
 pub fn timestamp_to_rfc3339_utc(ts: i64) -> String {
     timestamp_from_micros(ts, &Tz::UTC)

src/query/expression/src/types/timestamp_tz.rs

@@ -24,6 +24,7 @@ use databend_common_column::types::timestamp_tz;
 use databend_common_exception::ErrorCode;
 use databend_common_exception::Result;
 use databend_common_io::datetime::check_input_year;
+use databend_common_io::datetime::check_timezone_offset;
 use databend_common_io::datetime::parse_standard_timestamp as parse_iso_timestamp;
 use databend_common_timezone::LocalTimeResolution;
 use databend_common_timezone::resolve_local_datetime;
@@ -270,6 +271,7 @@ pub fn string_to_timestamp_tz<'a, F: FnOnce() -> &'a Tz>(
     for format in PARSE_FORMATS_WITH_OFFSET {
         if let Ok(value) = DateTime::parse_from_str(text, format) {
             check_input_year(value.year())?;
+            check_timezone_offset(value.offset().local_minus_utc())?;
             let micros = i128::from(value.timestamp()) * 1_000_000
                 + i128::from(value.timestamp_subsec_micros());
             return build_timestamp_tz(micros, value.offset().local_minus_utc());

src/query/expression/src/utils/auto_detect_datetime.rs

@@ -20,6 +20,7 @@ use chrono_tz::Tz;
 use databend_common_column::types::timestamp_tz;
 use databend_common_exception::ErrorCode;
 use databend_common_io::datetime::check_input_year;
+use databend_common_io::datetime::check_timezone_offset;
 use databend_common_timezone::fast_utc_from_local;
 use databend_common_timezone::offset_seconds_at;
 
@@ -128,14 +129,22 @@ impl ParsedDateTime {
     }
 }
 
-fn try_parse_formats(val: &str, tz: &Tz, formats: &[&str]) -> Option<(i64, i32)> {
+// A matched format with an invalid explicit offset is an error, not a signal
+// to try a more permissive parser. UTC range clamping remains the caller's policy.
+#[allow(clippy::result_large_err)]
+fn try_parse_formats(
+    val: &str,
+    tz: &Tz,
+    formats: &[&str],
+) -> Result<Option<(i64, i32)>, ErrorCode> {
     for format in formats {
         let Some(parsed) = ParsedDateTime::parse(format, val) else {
             continue;
         };
 
         match parsed.offset_seconds {
             Some(offset) => {
+                check_timezone_offset(offset)?;
                 let Some(date) = parsed.naive_date() else {
                     continue;
                 };
@@ -148,18 +157,20 @@ fn try_parse_formats(val: &str, tz: &Tz, formats: &[&str]) -> Option<(i64, i32)>
                 };
                 let micros = local.and_utc().timestamp() * MICROS_PER_SEC + parsed.micro as i64
                     - offset as i64 * MICROS_PER_SEC;
-                return Some((micros, offset));
+                return Ok(Some((micros, offset)));
             }
             None => {
                 let Some(micros) = fast_timestamp_from_parsed(&parsed, tz) else {
                     continue;
                 };
-                let offset = offset_seconds_at(tz, micros.div_euclid(MICROS_PER_SEC))?;
-                return Some((micros, offset));
+                let Some(offset) = offset_seconds_at(tz, micros.div_euclid(MICROS_PER_SEC)) else {
+                    continue;
+                };
+                return Ok(Some((micros, offset)));
             }
         }
     }
-    None
+    Ok(None)
 }
 
 pub fn fast_timestamp_from_parsed(parsed: &ParsedDateTime, tz: &Tz) -> Option<i64> {
@@ -175,10 +186,13 @@ pub fn fast_timestamp_from_parsed(parsed: &ParsedDateTime, tz: &Tz) -> Option<i6
     )
 }
 
-pub fn auto_detect_timestamp(val: &str, tz: &Tz) -> Option<i64> {
-    let (mut micros, _) = try_parse_formats(val, tz, AUTO_TS_FORMATS)?;
+#[allow(clippy::result_large_err)]
+pub fn auto_detect_timestamp(val: &str, tz: &Tz) -> Result<Option<i64>, ErrorCode> {
+    let Some((mut micros, _)) = try_parse_formats(val, tz, AUTO_TS_FORMATS)? else {
+        return Ok(None);
+    };
     clamp_timestamp(&mut micros);
-    Some(micros)
+    Ok(Some(micros))
 }
 
 pub fn auto_detect_date(val: &str) -> Option<i32> {
@@ -194,10 +208,13 @@ pub fn auto_detect_date(val: &str) -> Option<i32> {
     None
 }
 
-pub fn auto_detect_timestamp_tz(val: &str, tz: &Tz) -> Option<timestamp_tz> {
-    let (mut micros, offset) = try_parse_formats(val, tz, AUTO_TS_FORMATS)?;
+#[allow(clippy::result_large_err)]
+pub fn auto_detect_timestamp_tz(val: &str, tz: &Tz) -> Result<Option<timestamp_tz>, ErrorCode> {
+    let Some((mut micros, offset)) = try_parse_formats(val, tz, AUTO_TS_FORMATS)? else {
+        return Ok(None);
+    };
     clamp_timestamp(&mut micros);
-    Some(timestamp_tz::new(micros, offset))
+    Ok(Some(timestamp_tz::new(micros, offset)))
 }
 
 /// Parse a date string with optional auto-detect fallback.
@@ -226,12 +243,13 @@ pub fn parse_date_with_auto(val: &str, tz: &Tz, enable_auto: bool) -> Result<i32
 pub fn parse_timestamp_with_auto(val: &str, tz: &Tz, enable_auto: bool) -> Result<i64, ErrorCode> {
     match string_to_timestamp(val, tz) {
         Ok(micros) => Ok(micros),
+        Err(e) if e.code() == ErrorCode::INVALID_TIMEZONE => Err(e),
         Err(e) => {
             if enable_auto {
                 if let Some(micros) = parse_epoch_str(val) {
                     return Ok(micros);
                 }
-                if let Some(micros) = auto_detect_timestamp(val, tz) {
+                if let Some(micros) = auto_detect_timestamp(val, tz)? {
                     return Ok(micros);
                 }
             }
@@ -250,14 +268,15 @@ pub fn parse_timestamp_tz_with_auto(
 ) -> Result<timestamp_tz, ErrorCode> {
     match string_to_timestamp_tz(val.as_bytes(), || tz) {
         Ok(ts_tz) => Ok(ts_tz),
+        Err(e) if e.code() == ErrorCode::INVALID_TIMEZONE => Err(e),
         Err(e) => {
             if enable_auto {
                 if let Some(micros) = parse_epoch_str(val) {
                     let offset = offset_seconds_at(tz, micros.div_euclid(MICROS_PER_SEC))
                         .expect("validated Databend timestamp has a timezone offset");
                     return Ok(timestamp_tz::new(micros, offset));
                 }
-                if let Some(ts_tz) = auto_detect_timestamp_tz(val, tz) {
+                if let Some(ts_tz) = auto_detect_timestamp_tz(val, tz)? {
                     return Ok(ts_tz);
                 }
             }

src/query/expression/tests/it/types.rs

@@ -137,7 +137,6 @@ fn test_timestamp_display_clamps_bounds() {
             (-1_000_001, -1_000_001),
             (-1, -1),
             (0, 0),
-            (253_402_300_799_999_999, 253_402_300_799_999_999),
             (TIMESTAMP_MAX, TIMESTAMP_MAX),
             (TIMESTAMP_MAX + 1, TIMESTAMP_MAX),
             (i64::MAX, TIMESTAMP_MAX),
@@ -156,7 +155,7 @@ fn test_timestamp_display_clamps_bounds() {
     );
     assert_eq!(
         timestamp_to_rfc3339_utc(i64::MAX),
-        "+11000-12-31T23:59:59.999999Z"
+        "9999-12-31T23:59:59.999999Z"
     );
     assert_eq!(
         timestamp_to_rfc3339_utc(i64::MIN),