diff mbox series

[37/59] Tighten setuid TZif file name check

Message ID	20250105055750.1668721-38-eggert@cs.ucla.edu (mailing list archive)
State	New
Headers	DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 56D43385841E From: Paul Eggert <eggert@cs.ucla.edu> To: libc-alpha@sourceware.org Cc: Paul Eggert <eggert@cs.ucla.edu> Subject: [PATCH 37/59] Tighten setuid TZif file name check Date: Sat, 4 Jan 2025 21:57:12 -0800 Message-ID: <20250105055750.1668721-38-eggert@cs.ucla.edu> In-Reply-To: <01207110-bd60-46ae-9c08-fb39c2011067@cs.ucla.edu> References: <01207110-bd60-46ae-9c08-fb39c2011067@cs.ucla.edu> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: list Errors-To: libc-alpha-bounces~patchwork=sourceware.org@sourceware.org
Series	time: sync mktime from Gnulib \| [00/59] time: sync mktime from Gnulib [01/59] Split intprops.h into two [02/59] Support stdckdint.h internally if older GCC [03/59] Fix mishandling of default DST rule [04/59] Don't worry about !TZDEFAULT [05/59] Support static_assert in pre-C23 C [06/59] Sync mktime.c from Gnulib 2024-10-04 [07/59] Document mktime out-of-range + tm_isdst [08/59] Push tzset lock into callers of time functions [09/59] Omit parse_offset unnecessary tz == '\0' [10/59] Don’t assume TZif bloat is likely [11/59] tzset no longer calls ftello [12/59] Check TZif files more carefully [13/59] Remove alignment assumption from __tzfile_read [14/59] Treat oddball UTC offset strings as zero [15/59] Simplify __tz_compute [16/59] Improve performance in 2 BC [17/59] Don’t mishandle years < 1970 in compute_change [18/59] Match RFC 9636 names [19/59] Trivial tzset_internal speedup [20/59] Fix obscure bug when stdoffset == dstoffset [21/59] Document assumption that NO_DST == 0 [22/59] __use_tzfile is boolean [23/59] Minor tzfile.c clarity improvements [24/59] Stop using zic's -y option [25/59] Fix mishandling of default DST rule [26/59] Simplify treatment of missing and empty TZ [27/59] TZ="" always means UTC sans leap seconds [28/59] Prefer "UTC" for UTC [29/59] Simplify setting tz_rules to UTC [30/59] Update tzname etc. even if TZ is unchanged [31/59] "POSIX TZ" -> "proleptic TZ" [32/59] Reject invalid TZ strings in TZif files [33/59] Reject TZif files containing '\0' in TZ string [34/59] mktime should not consult 'daylight' [35/59] Remove __use_tzfile [36/59] Remove arbitrary limit on TZ, TZDIR lengths [37/59] Tighten setuid TZif file name check [38/59] Avoid a malloc in __tzfile_read [39/59] Free earlier in __tzfile_read [40/59] Improve __tzfile_read TZ="" comment [41/59] Refactor enum tz_rule_type [42/59] __offtime now returns struct tm [43/59] Fix overflow checking in offtime [44/59] Handle TZif time type 0 correctly [45/59] Remove invalid tzset tests from tst-bz29951.c [46/59] tzset, not localtime, now parses TZif TZ spec [47/59] Minor compute_change widening tweak [48/59] Minor SECSPERDAY widening tweak [49/59] Remove leap-second goto from __tzfile_compute [50/59] Remove use_last label from __tzfile_compute [51/59] Refactor ‘if’ in __tzfile_compute [52/59] Refactor localtime ‘if’ in __tzfile_compute [53/59] Refactor post-transition-table ‘if’ [54/59] Refactor __tzfile_compute to avoid two gotos [55/59] Refactor __tzfile_compute index local [56/59] mktime: prefer bool to int [57/59] mktime: port __mktime64 locking to Gnulib [58/59] mktime: improve tm_isdst heuristic [59/59] time: test DST adjustment for DST-less zones

Checks

Context	Check	Description
redhat-pt-bot/TryBot-apply_patch	success	Patch applied to master at the time it was sent

Commit Message

Paul Eggert Jan. 5, 2025, 5:57 a.m. UTC

  * time/tzfile.c (__tzfile_read): In a setuid program, reject TZ
settings like "/usr/share/zoneinfobad/Foo" which have a prefix
"/usr/share/zoneinfo" but do not refer to /usr/share/zoneinfo/*.
---
 time/tzfile.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/time/tzfile.c b/time/tzfile.c
index 678ecdd58b..8efe5b2ec9 100644
--- a/time/tzfile.c
+++ b/time/tzfile.c
@@ -140,7 +140,7 @@  decode64 (const void *ptr)
 bool
 __tzfile_read (const char *file)
 {
-  static const char default_tzdir[] = TZDIR;
+  static const char default_tzdir[] = TZDIR "/";
   tzidx isstdcnt, isutcnt;
   FILE *f;
   union { struct tzhead tzhead; tzidx tzidx_aligned; } u;
@@ -178,6 +178,7 @@  __tzfile_read (const char *file)
 	tzdir = default_tzdir;
 
       size_t tzdirlen = strlen (tzdir);
+      tzdirlen -= tzdir[tzdirlen - 1] == '/';
       size_t filelen = strlen (file);
       new = malloc (tzdirlen + 1 + filelen + 1);
       if (new == NULL)