diff mbox series

[33/59] Reject TZif files containing '\0' in TZ string

Message ID	20250105055750.1668721-34-eggert@cs.ucla.edu (mailing list archive)
State	New
Headers	DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 49DDC3858D21 From: Paul Eggert <eggert@cs.ucla.edu> To: libc-alpha@sourceware.org Cc: Paul Eggert <eggert@cs.ucla.edu> Subject: [PATCH 33/59] Reject TZif files containing '\0' in TZ string Date: Sat, 4 Jan 2025 21:57:08 -0800 Message-ID: <20250105055750.1668721-34-eggert@cs.ucla.edu> In-Reply-To: <01207110-bd60-46ae-9c08-fb39c2011067@cs.ucla.edu> References: <01207110-bd60-46ae-9c08-fb39c2011067@cs.ucla.edu> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: list Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org
Series	time: sync mktime from Gnulib \| [00/59] time: sync mktime from Gnulib [01/59] Split intprops.h into two [02/59] Support stdckdint.h internally if older GCC [03/59] Fix mishandling of default DST rule [04/59] Don't worry about !TZDEFAULT [05/59] Support static_assert in pre-C23 C [06/59] Sync mktime.c from Gnulib 2024-10-04 [07/59] Document mktime out-of-range + tm_isdst [08/59] Push tzset lock into callers of time functions [09/59] Omit parse_offset unnecessary tz == '\0' [10/59] Don’t assume TZif bloat is likely [11/59] tzset no longer calls ftello [12/59] Check TZif files more carefully [13/59] Remove alignment assumption from __tzfile_read [14/59] Treat oddball UTC offset strings as zero [15/59] Simplify __tz_compute [16/59] Improve performance in 2 BC [17/59] Don’t mishandle years < 1970 in compute_change [18/59] Match RFC 9636 names [19/59] Trivial tzset_internal speedup [20/59] Fix obscure bug when stdoffset == dstoffset [21/59] Document assumption that NO_DST == 0 [22/59] __use_tzfile is boolean [23/59] Minor tzfile.c clarity improvements [24/59] Stop using zic's -y option [25/59] Fix mishandling of default DST rule [26/59] Simplify treatment of missing and empty TZ [27/59] TZ="" always means UTC sans leap seconds [28/59] Prefer "UTC" for UTC [29/59] Simplify setting tz_rules to UTC [30/59] Update tzname etc. even if TZ is unchanged [31/59] "POSIX TZ" -> "proleptic TZ" [32/59] Reject invalid TZ strings in TZif files [33/59] Reject TZif files containing '\0' in TZ string [34/59] mktime should not consult 'daylight' [35/59] Remove __use_tzfile [36/59] Remove arbitrary limit on TZ, TZDIR lengths [37/59] Tighten setuid TZif file name check [38/59] Avoid a malloc in __tzfile_read [39/59] Free earlier in __tzfile_read [40/59] Improve __tzfile_read TZ="" comment [41/59] Refactor enum tz_rule_type [42/59] __offtime now returns struct tm [43/59] Fix overflow checking in offtime [44/59] Handle TZif time type 0 correctly [45/59] Remove invalid tzset tests from tst-bz29951.c [46/59] tzset, not localtime, now parses TZif TZ spec [47/59] Minor compute_change widening tweak [48/59] Minor SECSPERDAY widening tweak [49/59] Remove leap-second goto from __tzfile_compute [50/59] Remove use_last label from __tzfile_compute [51/59] Refactor ‘if’ in __tzfile_compute [52/59] Refactor localtime ‘if’ in __tzfile_compute [53/59] Refactor post-transition-table ‘if’ [54/59] Refactor __tzfile_compute to avoid two gotos [55/59] Refactor __tzfile_compute index local [56/59] mktime: prefer bool to int [57/59] mktime: port __mktime64 locking to Gnulib [58/59] mktime: improve tm_isdst heuristic [59/59] time: test DST adjustment for DST-less zones

Checks

Context	Check	Description
redhat-pt-bot/TryBot-apply_patch	success	Patch applied to master at the time it was sent

Commit Message

Paul Eggert Jan. 5, 2025, 5:57 a.m. UTC

  * time/tzfile.c (__tzfile_read): Don't allow TZif strings
that contain '\0'.  If a TZif file is longer than needed,
perhaps due to future TZif format, don't bother reading
the excess data.
---
 time/tzfile.c | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff mbox series

Patch

diff --git a/time/tzfile.c b/time/tzfile.c
index dae6b2b613..744c7690ab 100644
--- a/time/tzfile.c
+++ b/time/tzfile.c
@@ -258,7 +258,7 @@  __tzfile_read (const char *file)
       goto read_again;
     }
 
-  /* Compute the size of the proleptic time zone specification in the
+  /* Compute a bound on the size of the proleptic time zone specification in the
      file.  This includes the trailing but not the leading newline.  */
   size_t tzspec_size;
   if (trans_width == 8)
@@ -472,24 +472,33 @@  __tzfile_read (const char *file)
     types[i++].isutc = 0;
 
   /* Read the proleptic TZ information if possible.  */
-  if (tzspec != NULL)
+  if (tzspec_size != 0)
     {
-      char *nl;
-      assert (tzspec_size > 0);
-      /* Skip the leading newline, then grab everything up to the next
-	 newline; ignore everything after that.  */
-      if (__getc_unlocked (f) == '\n'
-	  && __fread_unlocked (tzspec, 1, tzspec_size, f) == tzspec_size
-	  && (nl = memchr (tzspec, '\n', tzspec_size)) != NULL)
-	*nl = '\0';
-      else
+      /* Don't use a TZ string not preceded by newline.  */
+      if (__getc_unlocked (f) != '\n')
+	goto lose;
+      size_t len = 0;
+      /* Grab everything up to the next newline.  Ignore the remaining
+	 part of the file as it may be a later TZif version.  */
+      for (int ch; (ch = __getc_unlocked (f)) != '\n'; )
+	{
+	  /* Don't use a truncated TZ string, or one containing '\0'.  */
+	  if (ch <= 0)
+	    goto lose;
+
+	  tzspec[len++] = ch;
+
+	  /* Don't use a TZ string that lacks a trailing newline.  */
+	  if (len == tzspec_size)
+	    goto lose;
+	}
+      tzspec[len] = '\0';
+
+      /* Don't use an empty TZ string.  */
+      if (len == 0)
 	tzspec = NULL;
     }
 
-  /* Don't use an empty TZ string.  */
-  if (tzspec != NULL && tzspec[0] == '\0')
-    tzspec = NULL;
-
   fclose (f);
 
   /* First "register" all time zone abbreviations.  */