[Bug libc/471] New: mktime problem when tm_year == INT_MAX and tm_mon > 12

["eggert at gnu dot org" <sourceware-bugzilla at sources dot redhat dot com>]

In mktime when tm_year is INT_MAX and tm_mon > 12, there's an integer
overflow in year computation that can cause incorrect results to be
returned.  Here is a patch.  This patch assumes the patch of bug#469.

2004-10-22  Paul Eggert  <eggert@cs.ucla.edu>

	Fix imported from gnulib.
	* time/mktime.c (leapyear, ydms_tm_diff): Year is of type
	long int, not int, to avoid problems when tm_year == INT_MAX
	and tm_mon > 12.
	(__mktime_intenral): Compute year using long int arithmetic,
	not int arithmetic, to avoid problems on hosts where time_t
	and long are 64 bits but int is 32.

--- 3/time/mktime.c	2004-10-22 12:55:10 -0700
+++ 4/time/mktime.c	2004-10-22 13:13:56 -0700
@@ -77,7 +77,7 @@ verify (base_year_is_a_multiple_of_100, 
 
 /* Return 1 if YEAR + TM_YEAR_BASE is a leap year.  */
 static inline int
-leapyear (int year)
+leapyear (long int year)
 {
   /* Don't add YEAR to TM_YEAR_BASE, as that might overflow.
      Also, work even if YEAR is negative.  */
@@ -119,7 +119,7 @@ const unsigned short int __mon_yday[2][1
    If TP is null, return a nonzero value.
    If overflow occurs, yield the low order bits of the correct answer.  */
 static time_t
-ydhms_tm_diff (int year, int yday, int hour, int min, int sec,
+ydhms_tm_diff (long int year, int yday, int hour, int min, int sec,
 	       const struct tm *tp)
 {
   if (!tp)
@@ -231,7 +231,8 @@ __mktime_internal (struct tm *tp,
   int mon_remainder = mon % 12;
   int negative_mon_remainder = mon_remainder < 0;
   int mon_years = mon / 12 - negative_mon_remainder;
-  int year = year_requested + mon_years;
+  long int lyear_requested = year_requested;
+  long int year = lyear_requested + mon_years;
 
   /* The other values need not be in range:
      the remaining code handles minor overflows correctly,

-- 
           Summary: mktime problem when tm_year == INT_MAX and tm_mon > 12
           Product: glibc
           Version: 2.3.3
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: gotom at debian dot or dot jp
        ReportedBy: eggert at gnu dot org
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: NA
  GCC host triplet: NA
GCC target triplet: NA
 BugsThisDependsOn: 469


http://sources.redhat.com/bugzilla/show_bug.cgi?id=471

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.