Re: New static analysis results

[Rich Felker <dalias@libc.org>]

On Fri, Sep 05, 2014 at 10:39:45PM +0400, Alexander Monakov wrote:
> On Fri, 5 Sep 2014, Rich Felker wrote:
> > > > ctime.c:5
> > > >     localtime(t) may return NULL, but that will cause UB in asctime
> > > 
> > > Yes, I need to look into what ctime should do in this case though...
> > 
> > Found it:
> > 
> >   7.27.3.2 The ctime function
> > 
> >   2 The ctime function converts the calendar time pointed to by timer
> >   to local time in the form of a string. It is equivalent to
> > 
> >            asctime(localtime(timer))
> > 
> > The standard basically specifies the implementation, so it's clearly
> > UB if localtime(t) would return a null pointer. Looks like no action
> > is needed here; the most-desirable-behavior (crash) for UB happens
> > automatically anyway.
> 
> I suspect what happened is, at some point localtime was not specified to
> return NULL and set errno, and at that time it made perfect sense to specify
> asctime as you quoted, and then at some later point localtime specification
> was expanded with error cases, but asctime specification was not adjusted.
> Is that possible?
> 
> It doesn't look very nice for a libc to invoke UB where it could easily
> propagate error to the caller, but "that's exactly what the standard requires"
> can't be argued with I guess.

See also asctime: it's even worse, specified to be UB, via potential
buffer overflow, if the values are outside of the expected range.

These functions really just should not be used for anything. Short of
rolling your own, strftime is the only correct way to format time as a
string.

At some point it would be nice to make a big list of standard C
functions that are utterly unusable due to UB on errors. Unusable due
to lack of thread safety is another big area, too.

Rich