When parsing a rule to rotate log files on a specific week day,
parseDWM() can advance the time to the next week. If the next week is
in the next month, then tm_mon is incremented. However, the increment
was failing to handle the wraparound from December to January, so when
parsing a rule during the last week of the December, the month would
advance to month 12. This triggered an out-of-bounds read of the
mtab[] array in days_pmonth() after parseDWM() returned.
The default rule for /var/log/weekly.conf triggers this during the
last week of December each year.
Reported by: CHERI
Obtained from: CheriBSD
Sponsored by: The University of Cambridge, Google Inc.