Bug 11478 - __tzset_parse_tz doesn't conform to POSIX
Summary: __tzset_parse_tz doesn't conform to POSIX
Status: RESOLVED INVALID
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.9
: P2 normal
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-04-08 11:39 UTC by Suzuki
Modified: 2014-06-30 18:17 UTC (History)
1 user (show)

See Also:
Host: all
Target: all
Build: all
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Suzuki 2010-04-08 11:39:33 UTC
The __tzset_parse_tz fails to parse the valid string formats as described by POSIX.

This was introduced with the following commit.

http://sourceware.org/git/?p=glibc.git;a=commit;h=82780cbee540bc7e61de6eb165d0f3ec7aa9e549

$ cat tzset-minimal.c 
#include <time.h>

extern char* tzname[];


main()
{

	tzset();
	printf ("std tzname is  %s\n", *tzname[0]?tzname[0]:"NULL");
	return 0;
}
$ TZ="A?BC0" ./tzset-minimal
std tzname is  NULL
Comment 1 Andreas Schwab 2010-04-08 11:49:43 UTC
POSIX does not specify the interpretation of this time zone string.
Comment 3 Suzuki 2010-04-08 12:02:50 UTC
The tzset() page points to the page for environment variables.

http://www.opengroup.org/onlinepubs/007908775/xsh/tzset.html ->

http://www.opengroup.org/onlinepubs/007908775/xbd/envvar.html
Comment 4 Ulrich Drepper 2010-04-08 12:12:07 UTC
(In reply to comment #3)
> The tzset() page points to the page for environment variables.
> 
> http://www.opengroup.org/onlinepubs/007908775/xsh/tzset.html ->
> 
> http://www.opengroup.org/onlinepubs/007908775/xbd/envvar.html

And?  The format is specified as

     std offset dst offset, rule

where std is either

  <[a-zA-Z0-9+-]{3,TZNAME_MAX}>

or

  [a-zA-Z]{3,TZNAME_MAX}

Nowhere a question mark is allowed.  That form is just invalid and the
implementation is correct to reject it.
Comment 5 Suzuki 2010-04-08 12:42:02 UTC
You are right. POSIX doesn't say it can be any character. It clearly says it
should be alphanumeric  in < > or alphabetic. It is the SUSv3 which says it can
be any character.

[ snip ]

Where:

std and dst

    Indicates no less than three, nor more than {TZNAME_MAX}, bytes that are the
designation for the standard ( std ) or the alternative ( dst - such as Daylight
Savings Time) timezone. Only std is required; if dst is missing, then the
alternative time does not apply in this locale. Upper- and lower-case letters
are explicitly allowed. Any graphic characters except a leading colon (:) or
digits, the comma (,), the minus (-), the plus (+), and the null character are
permitted to appear in these fields, but their meaning is unspecified.