[patch] Fix BZ 18985 out of bounds access in strftime

[Carlos O'Donell]

Paul,

The patch looks great, thanks for the fix.

One quibble about the test case.

On 09/20/2015 06:50 PM, Paul Pluzhnikov wrote:
> diff --git a/time/tst-strftime.c b/time/tst-strftime.c
> index 374fba4..5a592c2 100644
> --- a/time/tst-strftime.c
> +++ b/time/tst-strftime.c
> @@ -4,6 +4,24 @@
>  #include <time.h>
>  
>  
> +static int
> +do_bz18985 (void)
> +{
> +  char buf[1000];
> +  struct tm ttm;
> +
> +  memset (&ttm, 1, sizeof (ttm));
> +  ttm.tm_zone = NULL;  /* Dereferenced directly if non-NULL.  */
> +  strftime (buf, sizeof (buf), "%a %A %b %B %c %z %Z", &ttm);
> +
> +  /* Check negative values as well.  */
> +  memset (&ttm, 0xFF, sizeof (ttm));
> +  ttm.tm_zone = NULL;  /* Dereferenced directly if non-NULL.  */
> +  strftime (buf, sizeof (buf), "%a %A %b %B %c %z %Z", &ttm);

This test is insufficient.

We need comments about exactly what we are testing, and we need to
validate that the result is as expected. We should verify that the
resulting output has a `?' in the expected position. If we can't do that
then we've only validated half your change, namely that it doesn't
crash, but what if it starts returning valid values instead of `?'?

OK with that fixup.

> +
> +  return 0;
> +}
> +

Cheers,
Carlos.