# DF-3104 fix: validate month before using it as mon_lens index.
--- a/sys/vfs/udf/udf_vnops.c
@@ -251,7 +251,8 @@
 	t->tv_nsec = 0;
 
 	/* DirectCD seems to like using bogus year values */
-	if (time->year < 1970) {
+	/* month is used as an array index below, so validate it too. */
+	if (time->year < 1970 || time->month < 1 || time->month > 12) {
 		t->tv_sec = 0;
 		return;
 	}