fix(naive_time): enforce exact width when parsing %H%M%S

src/format/parse.rs

@@ -371,11 +371,18 @@ where
                     } else if s.starts_with('+') {
                         try_consume!(scan::number(&s[1..], 1, usize::MAX))
                     } else {
-                        // if there is no explicit sign, we respect the original `width`
+                        // Signed value with no sign — variable width (legacy behavior)
                         try_consume!(scan::number(s, 1, width))
                     }
                 } else {
-                    try_consume!(scan::number(s, 1, width))
+                    // Enforce exact width for unsigned values like %H, %M, %S
+                    if s.len() < width {
+                        return Err(TOO_SHORT);
+                    }
+                    let (val_str, rest) = s.split_at(width);
+                    let val = val_str.parse::<i64>().map_err(|_| INVALID)?;
+                    s = rest;
+                    val
                 };
                 set(parsed, v)?;
             }

src/naive/time/tests.rs

@@ -380,6 +380,26 @@ fn test_overflowing_offset() {
     assert_eq!(t.overflowing_sub_offset(positive_offset).0, t - positive_offset);
 }
 
+#[test]
+fn test_parse_from_str_enforces_exact_width() {
+    assert_eq!(
+        NaiveTime::parse_from_str("010203", "%H%M%S"),
+        Ok(NaiveTime::from_hms_opt(1, 2, 3).unwrap())
+    );
+
+    //  Too short — should fail
+    assert!(NaiveTime::parse_from_str("01023", "%H%M%S").is_err());
+
+    //  Too long — should fail
+    assert!(NaiveTime::parse_from_str("0102033", "%H%M%S").is_err());
+
+    //  Another valid time
+    assert_eq!(
+        NaiveTime::parse_from_str("235959", "%H%M%S"),
+        Ok(NaiveTime::from_hms_opt(23, 59, 59).unwrap())
+    );
+}
+
 #[test]
 #[cfg(feature = "rkyv-validation")]
 fn test_rkyv_validation() {