Bug 12401 - [PATCH] fix assertion in mktime.c
Summary: [PATCH] fix assertion in mktime.c
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-01-15 11:42 UTC by Robert Millan
Modified: 2014-06-27 12:28 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments
patch 1 (496 bytes, text/plain)
2011-01-15 11:42 UTC, Robert Millan
Details
patch 2 (255 bytes, patch)
2011-01-15 11:43 UTC, Robert Millan
Details | Diff
patch 3 (364 bytes, patch)
2011-01-15 11:43 UTC, Robert Millan
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Millan 2011-01-15 11:42:53 UTC
Created attachment 5195 [details]
patch 1

The following assertion in mktime.c:

   verify (long_int_year_and_yday_are_wide_enough,
          INT_MAX <= LONG_MAX / 2 || TIME_T_MAX <= UINT_MAX);

is not satisfiable on any ILP32 architecture with 64-bit time_t.

I propose the following patch to fix the problem.  Given the purpose of this assertion, I've split my patch in 3 to prove that it doesn't introduce any regression.  Here's my semi-formal proof:

First let A be (INT_MAX <= LONG_MAX / 2).

  - Patch #1: This works on the assumption that for any value of LONG_MAX, the whole function either works correctly or fails to compile. With my patch, if a certain condition A is met, every instance of `long' type is replaced with `time_t', and the assertion that checks for LONG_MAX now checks for TIME_T_MAX in its place. It must remain true that for any value of TIME_T_MAX, the whole function either works correctly or fails to compile, regardless of condition A.

  - Patch #2: If condition A is met, clearly the assertion will always suceed, so it can be removed.

  - Patch #3: If condition A is met, the second assertion is skipped, which is equivalent to making A one of its options.

(or in plain English, if longs are too short, time_ts can be used instead)
Comment 1 Robert Millan 2011-01-15 11:43:29 UTC
Created attachment 5196 [details]
patch 2
Comment 2 Robert Millan 2011-01-15 11:43:46 UTC
Created attachment 5197 [details]
patch 3
Comment 3 Robert Millan 2011-01-15 11:47:27 UTC
I forgot something regarding patch #1.  If the assert is going to pass with its left part, then condition A is met, and as a result long is used and its left part remains unmodified by my patch.  If the assert is going to pass with its right part, or not pass at all, then my change is not relevant.  So in either case, no regression is introduced.
Comment 4 Ulrich Drepper 2011-01-15 16:13:16 UTC
There are no ILP32 machine supported.  Why should anything be done?
Comment 5 Florian Weimer 2014-06-27 12:28:47 UTC
This should have been fixed in glibc 2.16 as part of the x32 port.