[PATCH 37/59] Tighten setuid TZif file name check

[Paul Eggert]

* time/tzfile.c (__tzfile_read): In a setuid program, reject TZ
settings like "/usr/share/zoneinfobad/Foo" which have a prefix
"/usr/share/zoneinfo" but do not refer to /usr/share/zoneinfo/*.
---
 time/tzfile.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/time/tzfile.c b/time/tzfile.c
index 678ecdd58b..8efe5b2ec9 100644
--- a/time/tzfile.c
+++ b/time/tzfile.c
@@ -140,7 +140,7 @@ decode64 (const void *ptr)
 bool
 __tzfile_read (const char *file)
 {
-  static const char default_tzdir[] = TZDIR;
+  static const char default_tzdir[] = TZDIR "/";
   tzidx isstdcnt, isutcnt;
   FILE *f;
   union { struct tzhead tzhead; tzidx tzidx_aligned; } u;
@@ -178,6 +178,7 @@ __tzfile_read (const char *file)
 	tzdir = default_tzdir;
 
       size_t tzdirlen = strlen (tzdir);
+      tzdirlen -= tzdir[tzdirlen - 1] == '/';
       size_t filelen = strlen (file);
       new = malloc (tzdirlen + 1 + filelen + 1);
       if (new == NULL)
-- 
2.45.2