aboutsummaryrefslogtreecommitdiff
path: root/time/asctime.c
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2005-10-14 14:10:20 +0000
committerUlrich Drepper <drepper@redhat.com>2005-10-14 14:10:20 +0000
commit576c8451485408d776914e756e5cc554e9d93eda (patch)
tree36c76940f6aaea04798eac3d55d4684bca69662e /time/asctime.c
parent93c6cb8b8d5c48944c82243b82713e97fd13dc17 (diff)
downloadglibc-576c8451485408d776914e756e5cc554e9d93eda.tar
glibc-576c8451485408d776914e756e5cc554e9d93eda.tar.gz
glibc-576c8451485408d776914e756e5cc554e9d93eda.tar.bz2
glibc-576c8451485408d776914e756e5cc554e9d93eda.zip
[BZ #1459]
* time/asctime.c (__asctime_r): Check for tm_year computation to overflow and fail in this case. * time/Makefile (tests): Add bug-asctime. * time/bug-asctime.c: New file.
Diffstat (limited to 'time/asctime.c')
-rw-r--r--time/asctime.c17
1 files changed, 16 insertions, 1 deletions
diff --git a/time/asctime.c b/time/asctime.c
index f20b311bb5..8ac4aa76a4 100644
--- a/time/asctime.c
+++ b/time/asctime.c
@@ -1,4 +1,5 @@
-/* Copyright (C) 1991,1993,1995-1997,2000,2002 Free Software Foundation, Inc.
+/* Copyright (C) 1991,1993,1995-1997,2000,2002,2005
+ Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
@@ -18,6 +19,7 @@
#include "../locale/localeinfo.h"
#include <errno.h>
+#include <limits.h>
#include <stdio.h>
#include <time.h>
@@ -47,6 +49,19 @@ __asctime_r (const struct tm *tp, char *buf)
return NULL;
}
+ /* We limit the size of the year which can be printed. Using the %d
+ format specifier used the addition of 1900 would overflow the
+ number and a negative vaue is printed. For some architectures we
+ could in theory use %ld or an evern larger integer format but
+ this would mean the output needs more space. This would not be a
+ problem if the 'asctime_r' interface would be defined sanely and
+ a buffer size would be passed. */
+ if (__builtin_expect (tp->tm_year > INT_MAX - 1900, 0))
+ {
+ __set_errno (EOVERFLOW);
+ return NULL;
+ }
+
if (sprintf (buf, format,
(tp->tm_wday < 0 || tp->tm_wday >= 7 ?
"???" : ab_day_name (tp->tm_wday)),