- tz - lists.iana.org

[PROPOSED] Increase TZ_MAX_CHARS from 50 to 256
by Paul Eggert Jan. 24, 2026

Jan. 24, 2026

With the current localtime.c implementation, increasing TZ_MAX_CHARS from 50 to its maximum value 256 does not allocate more memory, so there is little point to the limit of 50. * NEWS, localtime.c: Mention this. * tzfile.h (TZ_MAX_CHARS): Increase from 50 to 256. * zic.c (writezone): If -v, warn about going over the old limit. --- NEWS | 7 +++++++ localtime.c | 4 ++-- tzfile.h | 6 +++--- zic.c | 5 +++++ 4 files changed, 17 insertions(+), 5 deletions(-) diff --git a/NEWS b/NEWS index 95b1851c..dd592871 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,7 @@ Unreleased, experimental changes Briefly: The "right" TZif files are no longer installed by default. -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds. + TZif files are no longer limited to 50 bytes of abbreviations. Several integer overflow bugs have been fixed. Changes to build procedure @@ -29,6 +30,12 @@ Unreleased, experimental changes POSIX, shrinks tzcode's attack surface, and is more efficient, it fails to support Internet RFC 9636's leap seconds. + zic now can generate, and localtime.c can now use, TZif files that + hold up to 256 bytes of abbreviations, counting trailing NULs. + The previous limit was 50 bytes, and some tzdata TZif files were + already consuming 40 bytes. zic -v warns if it generates a file + that exceeds the old 50-byte limit. + localtime.c no longer accesses the posixrules file generated by zic -p. Hence for obsolete and nonconforming settings like TZ="AST4ADT" it now typically falls back on US DST rules, rather diff --git a/localtime.c b/localtime.c index ed7a32f2..32835d08 100644 --- a/localtime.c +++ b/localtime.c @@ -1227,8 +1227,8 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, if (tzparse(&up->buf[1], ts, sp)) { /* Attempt to reuse existing abbreviations. - Without this, America/Anchorage would be right on - the edge after 2037 when TZ_MAX_CHARS is 50, as + Without this, America/Anchorage would + consume 50 bytes for abbreviations, as sp->charcnt equals 40 (for LMT AST AWT APT AHST AHDT YST AKDT AKST) and ts->charcnt equals 10 (for AKST AKDT). Reusing means sp->charcnt can diff --git a/tzfile.h b/tzfile.h index 71b60f37..1b1bac4a 100644 --- a/tzfile.h +++ b/tzfile.h @@ -95,13 +95,13 @@ struct tzhead { #ifndef TZ_MAX_TYPES /* This must be at least 18 for Europe/Vilnius with 'zic -b fat'. */ -# define TZ_MAX_TYPES 256 /* Limited by what (unsigned char)'s can hold */ +# define TZ_MAX_TYPES 256 /* Limited to 256 by Internet RFC 9636. */ #endif /* !defined TZ_MAX_TYPES */ #ifndef TZ_MAX_CHARS /* This must be at least 40 for America/Anchorage. */ -# define TZ_MAX_CHARS 50 /* Maximum number of abbreviation characters */ - /* (limited by what unsigned chars can hold) */ +# define TZ_MAX_CHARS 256 /* Maximum number of abbreviation characters */ + /* (limited to 256 by Internet RFC 9636) */ #endif /* !defined TZ_MAX_CHARS */ #ifndef TZ_MAX_LEAPS diff --git a/zic.c b/zic.c index 73155138..1a2f4741 100644 --- a/zic.c +++ b/zic.c @@ -2986,6 +2986,11 @@ writezone(const char *const name, const char *const string, char version, continue; } + if (pass == 2 && noise && 50 < thischarcnt) + warning(_("%s: pre-2026 reference clients mishandle" + " more than 50 bytes of abbreviations"), + name); + /* Output a LO_TIME transition if needed; see limitrange. But do not go below the minimum representable value for this pass. */ -- 2.51.0

1 0

[PROPOSED] New -DTZ_RUNTIME_LEAPS=0 build-time option
by Paul Eggert Jan. 22, 2026

Jan. 22, 2026

This implements my suggestion in: https://lists.iana.org/hyperkitty/list/tz@iana.org/thread/Y4WLBYNBTFFG2XEQH… to add a compile-time option to disable localtime.c's support for leap seconds, and thereby shrink the attack surface on tzcode. * Makefile, NEWS, date.1, etcetera, zic.8: Mention this. * localtime.c (struct state): Define leapcnt and lsis members only if TZ_RUNTIME_LEAPS. All uses removed and replaced with the following: (leapcount, set_leapcount, lsinfo, set_lsinfo): New static getter and setter functions for leap second data. (tzloadbody) [!TZ_RUNTIME_LEAPS]: Reject TZif files with leap seconds. (gmtload) [!TZ_RUNTIME_LEAPS]: Do not load from TZLOAD_TZSTRING since we are not doing leap seconds. * private.h (TZ_RUNTIME_LEAPS, ATTRIBUTE_POSIX2TIME): New macros. (posix2time_z, time2posix_z): Declare with ATTRIBUTE_POSIX2TIME not ATTRIBUTE_PURE, because these functions are const (not merely pure) when leap seconds are disabled. --- Makefile | 4 ++ NEWS | 6 +++ date.1 | 2 +- etcetera | 3 +- localtime.c | 125 ++++++++++++++++++++++++++++++++++------------------ private.h | 13 +++++- zic.8 | 3 +- 7 files changed, 108 insertions(+), 48 deletions(-) diff --git a/Makefile b/Makefile index 021186fc..1e0a5903 100644 --- a/Makefile +++ b/Makefile @@ -328,6 +328,10 @@ LDLIBS= # -DTZ_DOMAIN=\"foo\" to use "foo" for gettext domain name; default is "tz" # -DTZ_DOMAINDIR=\"/path\" to use "/path" for gettext directory; # the default is system-supplied, typically "/usr/lib/locale" +# -DTZ_RUNTIME_LEAPS=0 to disable runtime support for leap seconds. +# This conforms to POSIX, shrinks tzcode's attack surface, +# and is more efficient. However, it fails to support Internet +# RFC 9636's leap seconds. # -DTZDEFRULESTRING=\",date/time,date/time\" to default to the specified # DST transitions for proleptic format TZ strings lacking them. # If not specified, it defaults to US rules for future DST transitions. diff --git a/NEWS b/NEWS index 995507f0..95b1851c 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ Unreleased, experimental changes Briefly: The "right" TZif files are no longer installed by default. + -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds. Several integer overflow bugs have been fixed. Changes to build procedure @@ -23,6 +24,11 @@ Unreleased, experimental changes Changes to code + Compiling with the new option -DTZ_RUNTIME_LEAPS=0 disables + runtime support for leap seconds. Although this conforms to + POSIX, shrinks tzcode's attack surface, and is more efficient, + it fails to support Internet RFC 9636's leap seconds. + localtime.c no longer accesses the posixrules file generated by zic -p. Hence for obsolete and nonconforming settings like TZ="AST4ADT" it now typically falls back on US DST rules, rather diff --git a/date.1 b/date.1 index 5f334358..8f2c212b 100644 --- a/date.1 +++ b/date.1 @@ -77,6 +77,6 @@ hexadecimal (leading 0x), preceded by an optional sign. .br /usr/share/zoneinfo timezone directory .br -/usr/share/zoneinfo/Etc/UTC for UTC leap seconds +/usr/share/zoneinfo/Etc/UTC for UTC leap seconds, if supported .SH SEE ALSO .BR strftime (3). diff --git a/etcetera b/etcetera index 948531c8..d78f0413 100644 --- a/etcetera +++ b/etcetera @@ -20,7 +20,8 @@ # which load the "UTC" file to handle seconds properly. Zone Etc/UTC 0 - UTC -# Functions like gmtime load the "GMT" file to handle leap seconds properly. +# If leap second support is enabled, functions like gmtime +# load the "GMT" file to handle leap seconds properly. # Vanguard section, which works with most .zi parsers. #Zone GMT 0 - GMT # Rearguard section, for TZUpdater 2.3.2 and earlier. diff --git a/localtime.c b/localtime.c index 40a4d7ee..ed7a32f2 100644 --- a/localtime.c +++ b/localtime.c @@ -498,7 +498,9 @@ enum { CHARS_EXTRA = max(sizeof UNSPEC, 2) - 1 }; are put on the stack and stacks are relatively small on some platforms. See tzfile.h for more about the sizes. */ struct state { +#if TZ_RUNTIME_LEAPS int leapcnt; +#endif int timecnt; int typecnt; int charcnt; @@ -509,9 +511,48 @@ struct state { struct ttinfo ttis[TZ_MAX_TYPES]; char chars[max(max(TZ_MAX_CHARS + CHARS_EXTRA, sizeof "UTC"), 2 * (TZNAME_MAXIMUM + 1))]; +#if TZ_RUNTIME_LEAPS struct lsinfo lsis[TZ_MAX_LEAPS]; +#endif }; +static int +leapcount(ATTRIBUTE_MAYBE_UNUSED struct state const *sp) +{ +#if TZ_RUNTIME_LEAPS + return sp->leapcnt; +#else + return 0; +#endif +} +static void +set_leapcount(ATTRIBUTE_MAYBE_UNUSED struct state *sp, + ATTRIBUTE_MAYBE_UNUSED int leapcnt) +{ +#if TZ_RUNTIME_LEAPS + sp->leapcnt = leapcnt; +#endif +} +static struct lsinfo +lsinfo(ATTRIBUTE_MAYBE_UNUSED struct state const *sp, + ATTRIBUTE_MAYBE_UNUSED int i) +{ +#if TZ_RUNTIME_LEAPS + return sp->lsis[i]; +#else + unreachable(); +#endif +} +static void +set_lsinfo(ATTRIBUTE_MAYBE_UNUSED struct state *sp, + ATTRIBUTE_MAYBE_UNUSED int i, + ATTRIBUTE_MAYBE_UNUSED struct lsinfo lsinfo) +{ +#if TZ_RUNTIME_LEAPS + sp->lsis[i] = lsinfo; +#endif +} + enum r_type { JULIAN_DAY, /* Jn = Julian day */ DAY_OF_YEAR, /* n = day of year */ @@ -1005,8 +1046,6 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, char version = up->tzhead.tzh_version[0]; bool skip_datablock = stored == 4 && version; int_fast32_t datablock_size; - int_fast64_t prevtr = -1; - int_fast32_2s prevcorr; int_fast32_2s ttisstdcnt = detzcode(up->tzhead.tzh_ttisstdcnt), ttisutcnt = detzcode(up->tzhead.tzh_ttisutcnt), @@ -1018,7 +1057,8 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Although tzfile(5) currently requires typecnt to be nonzero, support future formats that may allow zero typecnt in files that have a TZ string and no transitions. */ - if (! (0 <= leapcnt && leapcnt <= TZ_MAX_LEAPS + if (! (0 <= leapcnt + && leapcnt <= (TZ_RUNTIME_LEAPS ? TZ_MAX_LEAPS : 0) && 0 <= typecnt && typecnt <= TZ_MAX_TYPES && 0 <= timecnt && timecnt <= TZ_MAX_TIMES && 0 <= charcnt && charcnt <= TZ_MAX_CHARS @@ -1037,12 +1077,13 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, return EINVAL; if (skip_datablock) p += datablock_size; + else if (! ((ttisstdcnt == typecnt || ttisstdcnt == 0) + && (ttisutcnt == typecnt || ttisutcnt == 0))) + return EINVAL; else { - if (! ((ttisstdcnt == typecnt || ttisstdcnt == 0) - && (ttisutcnt == typecnt || ttisutcnt == 0))) - return EINVAL; - - sp->leapcnt = leapcnt; + int_fast64_t prevtr = -1; + int_fast32_2s prevcorr; + set_leapcount(sp, leapcnt); sp->timecnt = timecnt; sp->typecnt = typecnt; sp->charcnt = charcnt; @@ -1110,7 +1151,7 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Read leap seconds, discarding those out of time_t range. */ leapcnt = 0; - for (i = 0; i < sp->leapcnt; ++i) { + for (i = 0; i < leapcount(sp); i++) { int_fast64_t tr = stored == 4 ? detzcode(p) : detzcode64(p); int_fast32_2s corr = detzcode(p + stored); p += stored + 4; @@ -1135,12 +1176,14 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, prevcorr = corr; if (tr <= TIME_T_MAX) { - sp->lsis[leapcnt].ls_trans = tr; - sp->lsis[leapcnt].ls_corr = corr; + struct lsinfo ls; + ls.ls_trans = tr; + ls.ls_corr = corr; + set_lsinfo(sp, leapcnt, ls); leapcnt++; } } - sp->leapcnt = leapcnt; + set_leapcount(sp, leapcnt); for (i = 0; i < sp->typecnt; ++i) { register struct ttinfo * ttisp; @@ -1605,13 +1648,15 @@ tzparse(const char *name, struct state *sp, struct state const *basep) if (basep) { if (0 < basep->timecnt) atlo = basep->ats[basep->timecnt - 1]; - sp->leapcnt = basep->leapcnt; - if (0 < sp->leapcnt) { - memcpy(sp->lsis, basep->lsis, sp->leapcnt * sizeof *sp->lsis); - leaplo = sp->lsis[sp->leapcnt - 1].ls_trans; + set_leapcount(sp, leapcount(basep)); + if (0 < leapcount(sp)) { + int i; + for (i = 0; i < leapcount(sp); i++) + set_lsinfo(sp, i, lsinfo(basep, i)); + leaplo = lsinfo(sp, leapcount(sp) - 1).ls_trans; } } else - sp->leapcnt = 0; /* So, we're off a little. */ + set_leapcount(sp, 0); /* So, we're off a little. */ sp->goback = sp->goahead = false; if (*name != '\0') { struct rule start, end; @@ -1755,7 +1800,7 @@ tzparse(const char *name, struct state *sp, struct state const *basep) static void gmtload(struct state *const sp) { - if (tzload(etc_utc, sp, TZLOAD_TZSTRING) != 0) + if (!TZ_RUNTIME_LEAPS || tzload(etc_utc, sp, TZLOAD_TZSTRING) != 0) tzparse("UTC0", sp, NULL); } @@ -1787,7 +1832,7 @@ zoneinit(struct state *sp, char const *name, char tzloadflags) /* ** User wants it fast rather than right. */ - sp->leapcnt = 0; /* so, we're off a little */ + set_leapcount(sp, 0); /* so, we're off a little */ sp->timecnt = 0; sp->typecnt = 0; sp->charcnt = 0; @@ -2274,7 +2319,6 @@ static struct tm * timesub(const time_t *timep, int_fast32_t offset, const struct state *sp, struct tm *tmp) { - register const struct lsinfo * lp; register time_t tdays; register const int * ip; int_fast32_2s corr; @@ -2288,13 +2332,13 @@ timesub(const time_t *timep, int_fast32_t offset, time_t secs_since_posleap = SECSPERMIN; corr = 0; - i = (sp == NULL) ? 0 : sp->leapcnt; + i = sp ? leapcount(sp) : 0; while (--i >= 0) { - lp = &sp->lsis[i]; - if (*timep >= lp->ls_trans) { - corr = lp->ls_corr; - if ((i == 0 ? 0 : lp[-1].ls_corr) < corr) - secs_since_posleap = *timep - lp->ls_trans; + struct lsinfo ls = lsinfo(sp, i); + if (ls.ls_trans <= *timep) { + corr = ls.ls_corr; + if ((i == 0 ? 0 : lsinfo(sp, i - 1).ls_corr) < corr) + secs_since_posleap = *timep - ls.ls_trans; break; } } @@ -2948,14 +2992,13 @@ timegm(struct tm *tmp) static int_fast32_2s leapcorr(struct state const *sp, time_t t) { - register struct lsinfo const * lp; register int i; - i = sp->leapcnt; + i = leapcount(sp); while (--i >= 0) { - lp = &sp->lsis[i]; - if (t >= lp->ls_trans) - return lp->ls_corr; + struct lsinfo ls = lsinfo(sp, i); + if (ls.ls_trans <= t) + return ls.ls_corr; } return 0; } @@ -3031,13 +3074,12 @@ NETBSD_INSPIRED_EXTERN time_t posix2time_z(struct state *sp, time_t t) { int i; - for (i = sp->leapcnt; 0 <= --i; ) { - struct lsinfo *lp = &sp->lsis[i]; - int_fast32_2s corr = lp->ls_corr; + for (i = leapcount(sp); 0 <= --i; ) { + struct lsinfo ls = lsinfo(sp, i); time_t t_corr = t; - if (increment_overflow_time(&t_corr, corr)) { - if (0 <= corr) { + if (increment_overflow_time(&t_corr, ls.ls_corr)) { + if (0 <= ls.ls_corr) { /* Overflow near maximum time_t value with positive correction. This can happen with ordinary TZif files with leap seconds. */ errno = EOVERFLOW; @@ -3046,13 +3088,10 @@ posix2time_z(struct state *sp, time_t t) /* A negative correction overflowed, so keep going. This can happen with unrealistic-but-valid TZif files. */ } - } else { - time_t trans = lp->ls_trans; - if (trans <= t_corr) - return (t_corr - - (trans == t_corr - && (i == 0 ? 0 : sp->lsis[i - 1].ls_corr) < corr)); - } + } else if (ls.ls_trans <= t_corr) + return (t_corr + - (ls.ls_trans == t_corr + && (i == 0 ? 0 : lsinfo(sp, i - 1).ls_corr) < ls.ls_corr)); } return t; } diff --git a/private.h b/private.h index e8cf9c22..6a58b073 100644 --- a/private.h +++ b/private.h @@ -193,6 +193,10 @@ # define ctime_r _incompatible_ctime_r #endif /* HAVE_INCOMPATIBLE_CTIME_R */ +#ifndef TZ_RUNTIME_LEAPS +# define TZ_RUNTIME_LEAPS 1 +#endif + /* ** Nested includes */ @@ -922,11 +926,16 @@ time_t mktime_z(timezone_t restrict, struct tm *restrict); timezone_t tzalloc(char const *); void tzfree(timezone_t); # if STD_INSPIRED +# if TZ_RUNTIME_LEAPS +# define ATTRIBUTE_POSIX2TIME ATTRIBUTE_PURE +# else +# define ATTRIBUTE_POSIX2TIME ATTRIBUTE_CONST +# endif # if TZ_TIME_T || !defined posix2time_z -ATTRIBUTE_PURE time_t posix2time_z(timezone_t, time_t); +ATTRIBUTE_POSIX2TIME time_t posix2time_z(timezone_t, time_t); # endif # if TZ_TIME_T || !defined time2posix_z -ATTRIBUTE_PURE time_t time2posix_z(timezone_t, time_t); +ATTRIBUTE_POSIX2TIME time_t time2posix_z(timezone_t, time_t); # endif # endif #endif diff --git a/zic.8 b/zic.8 index 73b19ca9..05eea105 100644 --- a/zic.8 +++ b/zic.8 @@ -107,7 +107,8 @@ any already-existing link is removed. .BI "\-L " leapsecondfilename Read leap second information from the file with the given name. If this option is not used, -no leap second information appears in output files. +no leap second information appears in output files; +this is required by some TZif readers. .TP .BI "\-p " timezone Act as if the input contained a link line of the form -- 2.52.0

1 0

Greenland daylight saving during World War II
by Paul Eggert Jan. 22, 2026

Jan. 22, 2026

Greenland's been in the political news lately, and while reading about its history I found an unsourced statement in Wikipedia[1] that Greenland observed daylight saving time during World War II. I found a few published sources confirming this, but none with enough details for me to figure out what changes should go into tzdata. For now I installed the attached proposed patch which merely adds commentary. If someone could find the details we could fix the data accordingly. [1]: https://en.wikipedia.org/wiki/Greenland_in_World_War_II

1 0

[PROPOSED] TZ_MAX_TIMES must be at least 310 now
by Paul Eggert Jan. 22, 2026

Jan. 22, 2026

* tzfile.h: Asia/Hebron is the new champion. --- tzfile.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tzfile.h b/tzfile.h index d1f0fbe6..71b60f37 100644 --- a/tzfile.h +++ b/tzfile.h @@ -89,7 +89,7 @@ struct tzhead { */ #ifndef TZ_MAX_TIMES -/* This must be at least 242 for Europe/London with 'zic -b fat'. */ +/* This must be at least 310 for Asia/Hebron with 'zic -b fat'. */ # define TZ_MAX_TIMES 2000 #endif /* !defined TZ_MAX_TIMES */ -- 2.52.0

1 0

[PROPOSED] Fix pre-C23 typos in recent overflow fixes
by Paul Eggert Jan. 21, 2026

Jan. 21, 2026

* localtime.c (time2sub) [!defined ckd_sub]: Fix typos in Friday’s “Fix remaining Naveed8951-reported overflows” changes. This is needed for GCC 13 and earlier, and for other pre-C23 compilers that lack <stdckdint.h>. --- localtime.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/localtime.c b/localtime.c index 698f61bf..40a4d7ee 100644 --- a/localtime.c +++ b/localtime.c @@ -2697,8 +2697,8 @@ time2sub(struct tm *const tmp, v = ckd_sub(&offdiff, mytm.TM_GMTOFF, yourtm.TM_GMTOFF); # else /* A ckd_sub approximation that is good enough here. */ - v = !(-TWO_31_MINUS_1 <= yourm.TM_GMTOFF - && your.TM_GMTOFF <= TWO_31_MINUS_1); + v = !(-TWO_31_MINUS_1 <= yourtm.TM_GMTOFF + && yourtm.TM_GMTOFF <= TWO_31_MINUS_1); if (!v) offdiff = utoff_diff(mytm.TM_GMTOFF, yourtm.TM_GMTOFF); # endif -- 2.52.0

1 0

[PROPOSED] Support slightly-larger TZif files
by Paul Eggert Jan. 21, 2026

Jan. 21, 2026

* NEWS: Mention this. * localtime.c (tzloadbody): Fix off-by-one errors in tests that mistakenly caused the code to reject TZif files that actually fit. Problem introduced in release 2014g, by my commit 13a277175c603cfb62ae5bdcf26e23faf5619ef1 dated 2014-08-19. --- NEWS | 3 +++ localtime.c | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/NEWS b/NEWS index 71bd91e4..995507f0 100644 --- a/NEWS +++ b/NEWS @@ -43,6 +43,9 @@ Unreleased, experimental changes outlandish but conforming UT offsets or leap second corrections, has also been fixed. (Also reported by Naveed8951.) + localtime.c no longer rejects TZif files that exactly fit in its + internal structures, fixing off-by-one typos introduced in 2014g. + zic no longer generates a no-op transition when simultaneous Rule and Zone changes cancel each other out. This occurs in tzdata only in Asia/Tbilisi on 1997-03-30. diff --git a/localtime.c b/localtime.c index aa9b48ca..698f61bf 100644 --- a/localtime.c +++ b/localtime.c @@ -1018,12 +1018,12 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Although tzfile(5) currently requires typecnt to be nonzero, support future formats that may allow zero typecnt in files that have a TZ string and no transitions. */ - if (! (0 <= leapcnt && leapcnt < TZ_MAX_LEAPS - && 0 <= typecnt && typecnt < TZ_MAX_TYPES - && 0 <= timecnt && timecnt < TZ_MAX_TIMES - && 0 <= charcnt && charcnt < TZ_MAX_CHARS - && 0 <= ttisstdcnt && ttisstdcnt < TZ_MAX_TYPES - && 0 <= ttisutcnt && ttisutcnt < TZ_MAX_TYPES)) + if (! (0 <= leapcnt && leapcnt <= TZ_MAX_LEAPS + && 0 <= typecnt && typecnt <= TZ_MAX_TYPES + && 0 <= timecnt && timecnt <= TZ_MAX_TIMES + && 0 <= charcnt && charcnt <= TZ_MAX_CHARS + && 0 <= ttisstdcnt && ttisstdcnt <= TZ_MAX_TYPES + && 0 <= ttisutcnt && ttisutcnt <= TZ_MAX_TYPES)) return EINVAL; datablock_size = (timecnt * stored /* ats */ -- 2.51.0

1 0

[PROPOSED 0/3] Leap second overflow bugs
by Paul Eggert Jan. 20, 2026

Jan. 20, 2026

This patch series fixes some bugs involving integer overflow in leap second calculations at runtime. The main problem is with the optional time2posix and posix2time functions; without the patches the functions can crash or loop indefinitely or return completely-wrong answers. With these patches the functions have new, documented behavior: they return (time_t) -1 and set errno to EOVERFLOW when the result is not representable, instead of behaving badly in tricky situations. Given the problems I've been seeing with the leap second runtime code, and given the worry that similar problems remain, and given that the leap second runtime code is rarely used in practice, I'm thinking it may be a good idea to add a compile-time option to disable localtime.c's support for leap seconds. Using the option would shrink the attack surface on tzcode. Paul Eggert (3): Fix theoretical -2**31 leapcorr bug Improve time2posix man page Fix overflow bugs in time2posix and posix2time NEWS | 13 ++++- localtime.c | 90 +++++++++++++++++++++------------- time2posix.3 | 134 ++++++++++++++++++++++++++++++++++----------------- 3 files changed, 156 insertions(+), 81 deletions(-) -- 2.51.0

1 3

[PROPOSED] Check with -Wzero-as-null-pointer-constant
by Paul Eggert Jan. 19, 2026

Jan. 19, 2026

* Makefile (GCC_DEBUG_FLAGS): Omit -Wstringop-truncation, as it’s the default. Add -Wzero-as-null-pointer-constant. --- Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 570518c4..021186fc 100644 --- a/Makefile +++ b/Makefile @@ -380,12 +380,13 @@ GCC_DEBUG_FLAGS = -DGCC_LINT -g3 -O3 \ -Wold-style-definition -Woverlength-strings -Wpointer-arith \ -Wshadow -Wshift-overflow=2 -Wstrict-overflow \ -Wstrict-prototypes -Wstringop-overflow=4 \ - -Wstringop-truncation -Wsuggest-attribute=cold \ + -Wsuggest-attribute=cold \ -Wsuggest-attribute=const -Wsuggest-attribute=format \ -Wsuggest-attribute=malloc \ -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure \ -Wtrampolines -Wundef -Wunused-macros -Wuse-after-free=3 \ -Wvariadic-macros -Wvla -Wwrite-strings \ + -Wzero-as-null-pointer-constant \ -Wno-format-nonliteral -Wno-sign-compare -Wno-type-limits # # If your system has a "GMT offset" field in its "struct tm"s -- 2.51.0

1 0

[PROPOSED] Simplify int_fast32_t definition on C89 platforms
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

* private.h (int_fast32_t, INT_FAST32_MAX, INT_FAST32_MIN): When PORT_TO_C89 is defined, simplify these fallback definitions by using long rather than attempting to use int on platforms where int suffices. The attempt’s test was too strict: its ‘INT_MAX >> 31 == 0’ should have been ‘INT_MAX >> 30 == 0’. This led to a possible performance bug on C89 platforms where int is 32 bits, as int_fast32_t was defined to be long when int would suffice. C89 platforms are now museum pieces and this code is currently scheduled to be removed in 2029 or so anyway, so it is not worth trying to measure and debug any performance issues. Simplify the definitions instead. That mirrors what is already being done for uint_fast32_t. --- private.h | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/private.h b/private.h index 42a1c892..e8cf9c22 100644 --- a/private.h +++ b/private.h @@ -410,15 +410,9 @@ typedef long long int_fast64_t; # endif # ifndef INT_FAST32_MAX -# if INT_MAX >> 31 == 0 typedef long int_fast32_t; -# define INT_FAST32_MAX LONG_MAX -# define INT_FAST32_MIN LONG_MIN -# else -typedef int int_fast32_t; -# define INT_FAST32_MAX INT_MAX -# define INT_FAST32_MIN INT_MIN -# endif +# define INT_FAST32_MAX LONG_MAX +# define INT_FAST32_MIN LONG_MIN # endif # ifndef INT_LEAST32_MAX -- 2.51.0

1 0

Re: tzload: validate tt_utoff to avoid signed overflow
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

In <https://github.com/eggert/tz/pull/37> (2026-01-10) the GitHub user Naveed8951 writes: > The TZif specification guarantees that tt_utoff is never INT32_MIN > so that 32-bit clients can safely negate it. However, tzloadbody() > previously accepted unvalidated values from untrusted TZif input. > A malformed or malicious file could therefore trigger signed integer > overflow during later offset arithmetic (e.g., negation for timezone / > altzone or offset-difference calculations), which is undefined behavior > in C. Naveed8951 submitted a patch that would cause localtime.c to reject TZif files containing UT offsets outside the POSIX range -89999..93599 (-24:59:50 .. 25:59:59), the idea being that small offsets like that would not cause overflow. Unfortunately, I think such a change would still allow undefined behavior in some cases, as overflow could still happen when adding a small offset to a large tm_sec or time_t value. Also, Internet RFC 9636 section 3.2 allows (though it discourages) UT offsets outside the POSIX range. So instead, I fixed localtime.c to handle the outlandish offsets correctly. As a special case, localtime.c (and zic.c) now reject a UT offset exactly equal to -2**31, as RFC 9636 does not allow that and it can easily cause trouble in callers that negate a UT offset stored in a 32-bit integer.

1 0