* out of range struct tm fields in strftime
@ 2015-09-20 12:44 Szabolcs Nagy
2015-09-20 16:36 ` Rich Felker
0 siblings, 1 reply; 5+ messages in thread
From: Szabolcs Nagy @ 2015-09-20 12:44 UTC (permalink / raw)
To: musl
[-- Attachment #1: Type: text/plain, Size: 186 bytes --]
out of range tm fields should not be treated as ub
as noted in the thread
http://sourceware.org/ml/libc-alpha/2015-09/msg00546.html
i have a patch but there might be simpler approaches
[-- Attachment #2: 0001-fix-strftime-to-handle-out-of-range-tm-fields-withou.patch --]
[-- Type: text/x-diff, Size: 4543 bytes --]
From 042305a745991d2de8e7fd0111f158086d283f35 Mon Sep 17 00:00:00 2001
From: Szabolcs Nagy <nsz@port70.net>
Date: Sun, 20 Sep 2015 12:02:21 +0000
Subject: [PATCH] fix strftime to handle out of range tm fields without UB
Calling strftime with out of range tm fields is not undefined
behaviour, it should return a result (though in this case the stored
string is unspecified).
tm_wday, tm_yday, tm_mon and tm_year fields are used in signed int
arithmetics that may overflow. For tm_year long long arithmetics is
used and the rest is fixed by limiting the input.
---
src/time/strftime.c | 46 +++++++++++++++++++++++++---------------------
1 file changed, 25 insertions(+), 21 deletions(-)
diff --git a/src/time/strftime.c b/src/time/strftime.c
index e945bb7..464b546 100644
--- a/src/time/strftime.c
+++ b/src/time/strftime.c
@@ -19,27 +19,27 @@ static int is_leap(int y)
return !(y%4) && ((y%100) || !(y%400));
}
-static int week_num(const struct tm *tm)
+static int week_num(int wday, int yday, int year)
{
- int val = (tm->tm_yday + 7 - (tm->tm_wday+6)%7) / 7;
+ int val = (yday + 7 - (wday+6)%7) / 7;
/* If 1 Jan is just 1-3 days past Monday,
* the previous week is also in this year. */
- if ((tm->tm_wday - tm->tm_yday - 2 + 371) % 7 <= 2)
+ if ((wday - yday - 2 + 371) % 7 <= 2)
val++;
if (!val) {
val = 52;
/* If 31 December of prev year a Thursday,
* or Friday of a leap year, then the
* prev year has 53 weeks. */
- int dec31 = (tm->tm_wday - tm->tm_yday - 1 + 7) % 7;
- if (dec31 == 4 || (dec31 == 5 && is_leap(tm->tm_year%400-1)))
+ int dec31 = (wday - yday - 1 + 7) % 7;
+ if (dec31 == 4 || (dec31 == 5 && is_leap(year%400-1)))
val++;
} else if (val == 53) {
/* If 1 January is not a Thursday, and not
* a Wednesday of a leap year, then this
* year has only 52 weeks. */
- int jan1 = (tm->tm_wday - tm->tm_yday + 371) % 7;
- if (jan1 != 4 && (jan1 != 3 || !is_leap(tm->tm_year)))
+ int jan1 = (wday - yday + 371) % 7;
+ if (jan1 != 4 && (jan1 != 3 || !is_leap(year)))
val = 1;
}
return val;
@@ -55,19 +55,23 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
const char *fmt;
int width = 2;
+ int wday = tm->tm_wday < 7U ? tm->tm_wday : 0;
+ int yday = tm->tm_yday < 366U ? tm->tm_yday : 0;
+ int mon = tm->tm_mon < 12U ? tm->tm_mon : 0;
+
switch (f) {
case 'a':
- item = ABDAY_1 + tm->tm_wday;
+ item = ABDAY_1 + wday;
goto nl_strcat;
case 'A':
- item = DAY_1 + tm->tm_wday;
+ item = DAY_1 + wday;
goto nl_strcat;
case 'h':
case 'b':
- item = ABMON_1 + tm->tm_mon;
+ item = ABMON_1 + mon;
goto nl_strcat;
case 'B':
- item = MON_1 + tm->tm_mon;
+ item = MON_1 + mon;
goto nl_strcat;
case 'c':
item = D_T_FMT;
@@ -90,8 +94,8 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
case 'g':
case 'G':
val = tm->tm_year + 1900LL;
- if (tm->tm_yday < 3 && week_num(tm) != 1) val--;
- else if (tm->tm_yday > 360 && week_num(tm) == 1) val++;
+ if (yday < 3 && week_num(wday, yday, tm->tm_year) != 1) val--;
+ else if (yday > 360 && week_num(wday, yday, tm->tm_year) == 1) val++;
if (f=='g') val %= 100;
else width = 4;
goto number;
@@ -104,11 +108,11 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
else if (val > 12) val -= 12;
goto number;
case 'j':
- val = tm->tm_yday+1;
+ val = yday+1;
width = 3;
goto number;
case 'm':
- val = tm->tm_mon+1;
+ val = mon+1;
goto number;
case 'M':
val = tm->tm_min;
@@ -139,20 +143,20 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
fmt = "%H:%M:%S";
goto recu_strftime;
case 'u':
- val = tm->tm_wday ? tm->tm_wday : 7;
+ val = wday ? wday : 7;
width = 1;
goto number;
case 'U':
- val = (tm->tm_yday + 7 - tm->tm_wday) / 7;
+ val = (yday + 7 - wday) / 7;
goto number;
case 'W':
- val = (tm->tm_yday + 7 - (tm->tm_wday+6)%7) / 7;
+ val = (yday + 7 - (wday+6)%7) / 7;
goto number;
case 'V':
- val = week_num(tm);
+ val = week_num(wday, yday, tm->tm_year);
goto number;
case 'w':
- val = tm->tm_wday;
+ val = wday;
width = 1;
goto number;
case 'x':
@@ -165,7 +169,7 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
val = tm->tm_year % 100;
goto number;
case 'Y':
- val = tm->tm_year + 1900;
+ val = tm->tm_year + 1900LL;
if (val >= 10000) {
*l = snprintf(*s, sizeof *s, "+%lld", val);
return *s;
--
2.4.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: out of range struct tm fields in strftime
2015-09-20 12:44 out of range struct tm fields in strftime Szabolcs Nagy
@ 2015-09-20 16:36 ` Rich Felker
2015-09-20 16:44 ` Szabolcs Nagy
0 siblings, 1 reply; 5+ messages in thread
From: Rich Felker @ 2015-09-20 16:36 UTC (permalink / raw)
To: musl
On Sun, Sep 20, 2015 at 02:44:50PM +0200, Szabolcs Nagy wrote:
> out of range tm fields should not be treated as ub
> as noted in the thread
> http://sourceware.org/ml/libc-alpha/2015-09/msg00546.html
>
> i have a patch but there might be simpler approaches
Wouldn't it be less invasive to just make some small changes like
putting a U on some of the constants so that the arithmetic happens as
unsigned?
Rich
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: out of range struct tm fields in strftime
2015-09-20 16:36 ` Rich Felker
@ 2015-09-20 16:44 ` Szabolcs Nagy
2015-09-20 19:54 ` Szabolcs Nagy
0 siblings, 1 reply; 5+ messages in thread
From: Szabolcs Nagy @ 2015-09-20 16:44 UTC (permalink / raw)
To: musl
* Rich Felker <dalias@libc.org> [2015-09-20 12:36:29 -0400]:
> On Sun, Sep 20, 2015 at 02:44:50PM +0200, Szabolcs Nagy wrote:
> > out of range tm fields should not be treated as ub
> > as noted in the thread
> > http://sourceware.org/ml/libc-alpha/2015-09/msg00546.html
> >
> > i have a patch but there might be simpler approaches
>
> Wouldn't it be less invasive to just make some small changes like
> putting a U on some of the constants so that the arithmetic happens as
> unsigned?
>
that might be simpler (and probably generates better
code for div,mod by const)
but for the nl_langinfo item computation the range
has to be limited properly (tm_wday and tm_mon are
affected).
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: out of range struct tm fields in strftime
2015-09-20 16:44 ` Szabolcs Nagy
@ 2015-09-20 19:54 ` Szabolcs Nagy
2015-09-21 20:28 ` Rich Felker
0 siblings, 1 reply; 5+ messages in thread
From: Szabolcs Nagy @ 2015-09-20 19:54 UTC (permalink / raw)
To: musl
[-- Attachment #1: Type: text/plain, Size: 845 bytes --]
* Szabolcs Nagy <nsz@port70.net> [2015-09-20 18:44:35 +0200]:
> * Rich Felker <dalias@libc.org> [2015-09-20 12:36:29 -0400]:
> > On Sun, Sep 20, 2015 at 02:44:50PM +0200, Szabolcs Nagy wrote:
> > > out of range tm fields should not be treated as ub
> > > as noted in the thread
> > > http://sourceware.org/ml/libc-alpha/2015-09/msg00546.html
> > >
> > > i have a patch but there might be simpler approaches
> >
> > Wouldn't it be less invasive to just make some small changes like
> > putting a U on some of the constants so that the arithmetic happens as
> > unsigned?
> >
>
> that might be simpler (and probably generates better
> code for div,mod by const)
>
> but for the nl_langinfo item computation the range
> has to be limited properly (tm_wday and tm_mon are
> affected).
implemented this approach with wday%7U and using some 0U+
[-- Attachment #2: 0001-fix-strftime-to-handle-out-of-range-tm-fields-withou.patch --]
[-- Type: text/x-diff, Size: 3058 bytes --]
From e8891b06e0c698c0334f08e996f3b0d733f8ede7 Mon Sep 17 00:00:00 2001
From: Szabolcs Nagy <nsz@port70.net>
Date: Sun, 20 Sep 2015 19:41:23 +0000
Subject: [PATCH] fix strftime to handle out of range tm fields without UB
strftime returns unspecifed result with out of range tm fields, but
it should not invoke undefined behaviour.
tm_wday, tm_yday, tm_mon and tm_year fields were used in signed int
arithmetics that could overflow.
---
src/time/strftime.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/src/time/strftime.c b/src/time/strftime.c
index e945bb7..a1db37c 100644
--- a/src/time/strftime.c
+++ b/src/time/strftime.c
@@ -21,24 +21,24 @@ static int is_leap(int y)
static int week_num(const struct tm *tm)
{
- int val = (tm->tm_yday + 7 - (tm->tm_wday+6)%7) / 7;
+ int val = (tm->tm_yday + 7U - (tm->tm_wday+6U)%7) / 7;
/* If 1 Jan is just 1-3 days past Monday,
* the previous week is also in this year. */
- if ((tm->tm_wday - tm->tm_yday - 2 + 371) % 7 <= 2)
+ if ((0U + tm->tm_wday - tm->tm_yday - 2 + 371) % 7 <= 2)
val++;
if (!val) {
val = 52;
/* If 31 December of prev year a Thursday,
* or Friday of a leap year, then the
* prev year has 53 weeks. */
- int dec31 = (tm->tm_wday - tm->tm_yday - 1 + 7) % 7;
+ int dec31 = (0U + tm->tm_wday - tm->tm_yday - 1 + 7) % 7;
if (dec31 == 4 || (dec31 == 5 && is_leap(tm->tm_year%400-1)))
val++;
} else if (val == 53) {
/* If 1 January is not a Thursday, and not
* a Wednesday of a leap year, then this
* year has only 52 weeks. */
- int jan1 = (tm->tm_wday - tm->tm_yday + 371) % 7;
+ int jan1 = (0U + tm->tm_wday - tm->tm_yday + 371) % 7;
if (jan1 != 4 && (jan1 != 3 || !is_leap(tm->tm_year)))
val = 1;
}
@@ -57,17 +57,17 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
switch (f) {
case 'a':
- item = ABDAY_1 + tm->tm_wday;
+ item = ABDAY_1 + tm->tm_wday%7U;
goto nl_strcat;
case 'A':
- item = DAY_1 + tm->tm_wday;
+ item = DAY_1 + tm->tm_wday%7U;
goto nl_strcat;
case 'h':
case 'b':
- item = ABMON_1 + tm->tm_mon;
+ item = ABMON_1 + tm->tm_mon%12U;
goto nl_strcat;
case 'B':
- item = MON_1 + tm->tm_mon;
+ item = MON_1 + tm->tm_mon%12U;
goto nl_strcat;
case 'c':
item = D_T_FMT;
@@ -143,10 +143,10 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
width = 1;
goto number;
case 'U':
- val = (tm->tm_yday + 7 - tm->tm_wday) / 7;
+ val = (tm->tm_yday + 7U - tm->tm_wday) / 7;
goto number;
case 'W':
- val = (tm->tm_yday + 7 - (tm->tm_wday+6)%7) / 7;
+ val = (tm->tm_yday + 7U - (tm->tm_wday+6U)%7) / 7;
goto number;
case 'V':
val = week_num(tm);
@@ -165,7 +165,7 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
val = tm->tm_year % 100;
goto number;
case 'Y':
- val = tm->tm_year + 1900;
+ val = tm->tm_year + 1900LL;
if (val >= 10000) {
*l = snprintf(*s, sizeof *s, "+%lld", val);
return *s;
--
2.4.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: out of range struct tm fields in strftime
2015-09-20 19:54 ` Szabolcs Nagy
@ 2015-09-21 20:28 ` Rich Felker
0 siblings, 0 replies; 5+ messages in thread
From: Rich Felker @ 2015-09-21 20:28 UTC (permalink / raw)
To: musl
On Sun, Sep 20, 2015 at 09:54:50PM +0200, Szabolcs Nagy wrote:
> * Szabolcs Nagy <nsz@port70.net> [2015-09-20 18:44:35 +0200]:
> > * Rich Felker <dalias@libc.org> [2015-09-20 12:36:29 -0400]:
> > > On Sun, Sep 20, 2015 at 02:44:50PM +0200, Szabolcs Nagy wrote:
> > > > out of range tm fields should not be treated as ub
> > > > as noted in the thread
> > > > http://sourceware.org/ml/libc-alpha/2015-09/msg00546.html
> > > >
> > > > i have a patch but there might be simpler approaches
> > >
> > > Wouldn't it be less invasive to just make some small changes like
> > > putting a U on some of the constants so that the arithmetic happens as
> > > unsigned?
> > >
> >
> > that might be simpler (and probably generates better
> > code for div,mod by const)
> >
> > but for the nl_langinfo item computation the range
> > has to be limited properly (tm_wday and tm_mon are
> > affected).
>
> implemented this approach with wday%7U and using some 0U+
> static int week_num(const struct tm *tm)
> {
> - int val = (tm->tm_yday + 7 - (tm->tm_wday+6)%7) / 7;
> + int val = (tm->tm_yday + 7U - (tm->tm_wday+6U)%7) / 7;
> /* If 1 Jan is just 1-3 days past Monday,
> * the previous week is also in this year. */
> - if ((tm->tm_wday - tm->tm_yday - 2 + 371) % 7 <= 2)
> + if ((0U + tm->tm_wday - tm->tm_yday - 2 + 371) % 7 <= 2)
> val++;
> if (!val) {
> val = 52;
> /* If 31 December of prev year a Thursday,
> * or Friday of a leap year, then the
> * prev year has 53 weeks. */
> - int dec31 = (tm->tm_wday - tm->tm_yday - 1 + 7) % 7;
> + int dec31 = (0U + tm->tm_wday - tm->tm_yday - 1 + 7) % 7;
This is okay but it might (or might not) be less ugly to just reorder
the constants to avoid the 0U. Thoughts?
> @@ -57,17 +57,17 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
>
> switch (f) {
> case 'a':
> - item = ABDAY_1 + tm->tm_wday;
> + item = ABDAY_1 + tm->tm_wday%7U;
This is going to be a significant code size increase on many archs,
and possibly significant performance cost too. I wonder if there's a
better way.
> @@ -143,10 +143,10 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
> width = 1;
> goto number;
> case 'U':
> - val = (tm->tm_yday + 7 - tm->tm_wday) / 7;
> + val = (tm->tm_yday + 7U - tm->tm_wday) / 7;
These look fine.
> @@ -165,7 +165,7 @@ const char *__strftime_fmt_1(char (*s)[100], size_t *l, int f, const struct tm *
> val = tm->tm_year % 100;
> goto number;
> case 'Y':
> - val = tm->tm_year + 1900;
> + val = tm->tm_year + 1900LL;
Also looks ok. Hopefully the compiler does not actually evaluate in
64-bit.
Rich
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2015-09-21 20:28 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-09-20 12:44 out of range struct tm fields in strftime Szabolcs Nagy
2015-09-20 16:36 ` Rich Felker
2015-09-20 16:44 ` Szabolcs Nagy
2015-09-20 19:54 ` Szabolcs Nagy
2015-09-21 20:28 ` Rich Felker
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).