From e2739ba6310893be93d01a23cbfed8d8dfb08966 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Wed, 11 Nov 2020 19:20:42 -0800 Subject: [PATCH 3/3] time_rz: simplify CVE-2017-7476 fix * lib/time_rz.c: Do not include limits.h; I think it was included under the mistaken impression that limits.h defines SIZE_MAX. (SIZE_MAX): Remove. (save_abbr): Put string length into a ptrdiff_t variable, so that the size comparison works naturally. This fixes CVE-2017-7476 in a cleaner way. --- ChangeLog | 8 ++++++++ lib/time_rz.c | 15 ++------------- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/ChangeLog b/ChangeLog index 530c9a661..fe298605e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,13 @@ 2020-11-11 Paul Eggert + time_rz: simplify CVE-2017-7476 fix + * lib/time_rz.c: Do not include limits.h; I think it was included + under the mistaken impression that limits.h defines SIZE_MAX. + (SIZE_MAX): Remove. + (save_abbr): Put string length into a ptrdiff_t variable, + so that the size comparison works naturally. This + fixes CVE-2017-7476 in a cleaner way. + parse-datetime: streamline overflow checking When parse-datetime.y’s overflow code was written, INT_ADD_WRAPV did not work for unsigned destinations, and since time_t might diff --git a/lib/time_rz.c b/lib/time_rz.c index c58e6831b..a33b8078b 100644 --- a/lib/time_rz.c +++ b/lib/time_rz.c @@ -27,7 +27,6 @@ #include #include -#include #include #include #include @@ -36,10 +35,6 @@ #include "flexmember.h" #include "time-internal.h" -#ifndef SIZE_MAX -# define SIZE_MAX ((size_t) -1) -#endif - /* The approximate size to use for small allocation requests. This is the largest "small" request for the GNU C library malloc. */ enum { DEFAULT_MXFAST = 64 * sizeof (size_t) / 4 }; @@ -125,14 +120,8 @@ save_abbr (timezone_t tz, struct tm *tm) { if (! (*zone_copy || (zone_copy == tz->abbrs && tz->tz_is_set))) { - size_t zone_size = strlen (zone) + 1; - size_t zone_used = zone_copy - tz->abbrs; - if (SIZE_MAX - zone_used < zone_size) - { - errno = ENOMEM; - return false; - } - if (zone_used + zone_size < ABBR_SIZE_MIN) + ptrdiff_t zone_size = strlen (zone) + 1; + if (zone_size < tz->abbrs + ABBR_SIZE_MIN - zone_copy) extend_abbrs (zone_copy, zone, zone_size); else { -- 2.25.1