Bug 1459 - ctime, asctime produce negative year number
Summary: ctime, asctime produce negative year number
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.3.5
: P2 minor
Target Milestone: ---
Assignee: GOTO Masanori
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-10-11 09:54 UTC by Jim Meyering
Modified: 2016-05-20 19:52 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jim Meyering 2005-10-11 09:54:58 UTC
When the year number is between INT_MAX-1900 and INT_MAX,
ctime, asctime, ctime_t, asctime_t all format a negative
year number, e.g., -2147483648.  They should probably return NULL instead.
Of course, this happens only when time_t is a 64-bit type and int (tm_year)
is a 32-bit type.

The problem is in time/asctime.c (today's CVS).
See the unchecked `+ 1900' below.  It can overflow:

  if (sprintf (buf, format,
	       (tp->tm_wday < 0 || tp->tm_wday >= 7 ?
		"???" : ab_day_name (tp->tm_wday)),
	       (tp->tm_mon < 0 || tp->tm_mon >= 12 ?
		"???" : ab_month_name (tp->tm_mon)),
	       tp->tm_mday, tp->tm_hour, tp->tm_min,
	       tp->tm_sec, 1900 + tp->tm_year) < 0)
Comment 1 Ulrich Drepper 2005-10-14 14:09:55 UTC
I checked in a patch in the CVS trunk.