Bug 1459

Summary: ctime, asctime produce negative year number
Product: glibc Reporter: Jim Meyering <list+redhat-bugzilla>
Component: libcAssignee: GOTO Masanori <gotom>
Status: RESOLVED FIXED    
Severity: minor CC: glibc-bugs
Priority: P2 Flags: fweimer: security-
Version: 2.3.5   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:

Description Jim Meyering 2005-10-11 09:54:58 UTC
When the year number is between INT_MAX-1900 and INT_MAX,
ctime, asctime, ctime_t, asctime_t all format a negative
year number, e.g., -2147483648.  They should probably return NULL instead.
Of course, this happens only when time_t is a 64-bit type and int (tm_year)
is a 32-bit type.

The problem is in time/asctime.c (today's CVS).
See the unchecked `+ 1900' below.  It can overflow:

  if (sprintf (buf, format,
	       (tp->tm_wday < 0 || tp->tm_wday >= 7 ?
		"???" : ab_day_name (tp->tm_wday)),
	       (tp->tm_mon < 0 || tp->tm_mon >= 12 ?
		"???" : ab_month_name (tp->tm_mon)),
	       tp->tm_mday, tp->tm_hour, tp->tm_min,
	       tp->tm_sec, 1900 + tp->tm_year) < 0)
Comment 1 Ulrich Drepper 2005-10-14 14:09:55 UTC
I checked in a patch in the CVS trunk.