[Bug libc/469] New: mktime bug when INT_MAX - 1900 < tm_year

["eggert at gnu dot org" <sourceware-bugzilla at sources dot redhat dot com>]

When the tm_year component is greater than INT_MAX - 1900, mktime
has a problem: it adds 1900 to tm_year and then tests whether the
result is a leap year.  Because the addition overflows, the resulting
behavior is undefined.

Here is a patch, imported from gnulib.

2004-10-22  Paul Eggert  <eggert@cs.ucla.edu>

	Import a fix from gnulib.
	* time/mktime.c (__isleap): Remove; all uses replaced by:
	(leapyear): New function, which avoids overflow by not adding
	1900 to year before testing whether it is a leap year.

--- 1/time/mktime.c	2004-10-22 12:24:21 -0700
+++ 2/time/mktime.c	2004-10-22 12:39:29 -0700
@@ -75,12 +75,17 @@ verify (right_shift_propagates_sign, -1 
 #define TM_YEAR_BASE 1900
 verify (base_year_is_a_multiple_of_100, TM_YEAR_BASE % 100 == 0);
 
-#ifndef __isleap
-/* Nonzero if YEAR is a leap year (every 4 years,
-   except every 100th isn't, and every 400th is).  */
-# define __isleap(year)	\
-  ((year) % 4 == 0 && ((year) % 100 != 0 || (year) % 400 == 0))
-#endif
+/* Return 1 if YEAR + TM_YEAR_BASE is a leap year.  */
+static inline int
+leapyear (int year)
+{
+  /* Don't add YEAR to TM_YEAR_BASE, as that might overflow.
+     Also, work even if YEAR is negative.  */
+  return
+    ((year & 3) == 0
+     && (year % 100 != 0
+	 || ((year / 100) & 3) == (- (TM_YEAR_BASE / 100) & 3)));
+}
 
 /* How many days come before each month (0-12).  */
 #ifndef _LIBC
@@ -234,7 +239,7 @@ __mktime_internal (struct tm *tp,
 
   /* Calculate day of year from year, month, and day of month.
      The result need not be in range.  */
-  int yday = ((__mon_yday[__isleap (year + TM_YEAR_BASE)]
+  int yday = ((__mon_yday[leapyear (year)]
 	       [mon_remainder + 12 * negative_mon_remainder])
 	      + mday - 1);

-- 
           Summary: mktime bug when INT_MAX - 1900 < tm_year
           Product: glibc
           Version: 2.3.3
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: gotom at debian dot or dot jp
        ReportedBy: eggert at gnu dot org
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: N.A.
  GCC host triplet: N.A.
GCC target triplet: N.A.


http://sources.redhat.com/bugzilla/show_bug.cgi?id=469

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.