fix: Validate tm put into strftime (#510)

src/sentry_utils.c

@@ -367,6 +367,12 @@ sentry__msec_time_to_iso8601(uint64_t time)
     struct tm tm_buf;
     tm = gmtime_r(&secs, &tm_buf);
 #endif
+    // It might as well be that the `time` parameter is broken in some way and
+    // would create a broken `tm` that then later causes formatting issues. We
+    // have seen super strange timestamps in some event payloads.
+    if (!tm || tm->tm_year > 9000) {
+        return NULL;
+    }
     size_t written = strftime(buf, buf_len, "%Y-%m-%dT%H:%M:%S", tm);
     if (written == 0) {
         return NULL;

src/sentry_value.c

@@ -911,6 +911,9 @@ sentry_value_to_msgpack(sentry_value_t value, size_t *size_out)
 sentry_value_t
 sentry__value_new_string_owned(char *s)
 {
+    if (!s) {
+        return sentry_value_new_null();
+    }
     sentry_value_t rv
         = new_thing_value(s, THING_TYPE_STRING | THING_TYPE_FROZEN);
     if (sentry_value_is_null(rv)) {