calendarspec: reject strings with spurious spaces and signs

strtoul() parses leading whitespace and an optional sign;
check that the first character is a digit to prevent odd
specifications like "00:  00:  00" and "-00:+00/-1".

src/basic/calendarspec.c

@@ -18,6 +18,7 @@
 ***/
 
 #include <alloca.h>
+#include <ctype.h>
 #include <errno.h>
 #include <stddef.h>
 #include <stdio.h>
@@ -458,6 +459,9 @@ static int parse_component_decimal(const char **p, bool usec, unsigned long *res
         char *ee = NULL;
         int r;
 
+        if (!isdigit(**p))
+                return -EINVAL;
+
         errno = 0;
         value = strtoul(*p, &ee, 10);
         if (errno > 0)