[PATCH] time: Avoid memcmp overread in tzset (bug 31931)

[Florian Weimer]

* Andreas Schwab:

> On Jun 26 2024, Florian Weimer wrote:
>
>> I'm having second thoughts, though.  Should we support this as an
>> memcmp extension?  See: git grep -E 'memcmp.*sizeof\s*\("'
>> And glibc isn't the only project that does that:
>>
>> <https://codesearch.debian.net/search?q=memcmp.*sizeof%5Cs*%5C%28%22&literal=0>
>
> Do any of those uses fail to check the size of the arguments?  At least
> in glibc we are clean.

Some do not, this one for example:

“
/* coverity[-tainted_data_sink: arg-1] */
static int mod_extforward_hap_PROXY_v1 (connection * const con,
                                        union hap_PROXY_hdr * const hdr)
{
…
    char *s = hdr->v1.line + sizeof("PROXY")-1; /*checked in hap_PROXY_recv()*/
    char *src_addr, *dst_addr, *src_port, *dst_port;
    int family;
    int src_lport, dst_lport;
    if (*s != ' ') return -1;
    ++s;
    if (s[0] == 'T' && s[1] == 'C' && s[2] == 'P' && s[4] == ' ') {
        if (s[3] == '4') {
            family = AF_INET;
        } else if (s[3] == '6') {
            family = AF_INET6;
        }
        else {
            return -1;
        }
        s += 5;
    }
    else if (0 == memcmp(s, "UNKNOWN", sizeof("UNKNOWN")-1)
             && (s[7] == '\0' || s[7] == ' ')) {
        return 0;     /* keep local connection address */
…
”

<https://sources.debian.org/src/lighttpd/1.4.76-1/src/mod_extforward.c/?hl=1449#L1449>

This seems to be another example:

  <https://sources.debian.org/src/nvi/1.81.6-22/ipc/ip_run.c/?hl=73#L73>

I get the impression the list is rather long.

Thanks,
Florian