Re: Seg Fault in strftime

[Corinna Vinschen <corinna-cygwin@cygwin.com>]

[-- Attachment #1: Type: text/plain, Size: 3615 bytes --]

On Aug  1 18:47, Michael Enright wrote:
> On Sat, Aug 1, 2015 at 2:47 PM, Brian Inglis  wrote:
> > Two problems I have encountered in the past with manually constructed struct tm:
> > - failing to set struct tm.tm_isdst member to -1, or any negative value, so
> > that mktime(3) will determine whether DST is in effect, and set the struct
> > tm.tzname array from the tzdb
> 
> The code calls strftime after setting tm_isdst from its own struct's
> corresponding flag.
> 
> > - failing to call mktime(3) for each struct tm variable to normalize the
> > struct tm members, determine if DST is in effect if struct tm.tm_isdst
> > member is -1, and set the struct tm.tzname array from the tzdb.
> > Check back in the code to see if struct tm.tm_isdst is set and to what
> > value, and if mktime(3) is called on each struct tm after it is filled.
> 
> The code doesn't call mktime at all.
> >
> > - failing to call mktime()
> >
> 
> See above.
> 
> There is a section of the code that I believe is meant to be
> configured in but it is not. This code calls localtime_r with a time_t
> of zero and copies the resulting tm_gmtoff and tm_zone into the struct
> tm that the routine will call strftime on. This code starts at line
> 621, http://hg.mozilla.org/releases/mozilla-1.9.1/file/920bcf17a9e1/js/src/prmjtime.cpp#l621
> to jump to that line.
> 
> The things you advocate doing are super-responsible things to do. I
> have a huge investment in using this particular library and now I'm
> twisting in the wind because someone else appears not to have done all
> the super responsible things they should have done.
> 
> I have found there is tons of code out there manually filling in
> struct tm's and then filing bugs in glibc (not just newlib problem)
> when things go wrong. And then without even the courtesy of a citation
> of a spec these bugs are resolved WONTFIX because these upstreams
> believe they have the right to insist that struct tm's should NEVER
> manually be filled in and why would you do it anyway. I think the
> minimum struct members specified on POSIX should be considered the API
> to any function that reads struct tm, not because POSIX says so but
> because it is the way to keep machines from getting pwned through
> crash bugs.

The core thingy in POSIX is "The <time.h> header shall declare the tm
structure, which shall include at least the following members:"
                               ^^^^^^^^

A conforming application does not use such a structure which isn't
*at least* initialized to all 0 (memset).

The Cygwin implementation is basically equivalent here to the Glibc
implementation.  For the reason why doing that is the right thing,
see https://sourceware.org/ml/newlib/2015/msg00008.html

If your executable has been built prior to releasing this new code,
Cygwin won't require tm_zone and tm_gmtoff anyway.  However, for later
built executables it will, and then there's no way around the crash
if tm_zone is uninitialized.  If it's NULL, you'll get the current
timezone.  But if it's not NULL it's suppsoed to be a pointer to
a valid string.  How is a library supposed to know that the pointer
value is just garbage?

Therefore, if you (or the code you have to maintain) wants to fill out
struct tm manually, fine, just make sure to memset it beforehand.  In
that case you can be sure that both, glibc and newlib/Cygwin, will
not crash.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]