- tz - lists.iana.org

Fwd: [PATCH] zic: avoid integer truncation in stringoffset bounds check
by Naveed Khan April 1, 2026

April 1, 2026

---------- Forwarded message --------- From: <dxbnaveed.k(a)gmail.com> Date: Wed, Mar 18, 2026 at 2:13 AM Subject: [PATCH] zic: avoid integer truncation in stringoffset bounds check To: <tz(a)iana.org> Cc: rootvector2 <dxbnaveed.k(a)gmail.com> From: rootvector2 <dxbnaveed.k(a)gmail.com> --- zic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/zic.c b/zic.c index c0891001..64090fce 100644 --- a/zic.c +++ b/zic.c @@ -3171,6 +3171,7 @@ stringoffset(char *result, zic_t offset) register int hours; register int minutes; register int seconds; + zic_t zhours; bool negative = offset < 0; int len = negative; @@ -3182,11 +3183,12 @@ stringoffset(char *result, zic_t offset) offset /= SECSPERMIN; minutes = offset % MINSPERHOUR; offset /= MINSPERHOUR; - hours = offset; - if (hours >= HOURSPERDAY * DAYSPERWEEK) { + zhours = offset; + if (zhours >= HOURSPERDAY * DAYSPERWEEK) { result[0] = '\0'; return 0; } + hours = zhours; len += sprintf(result + len, "%d", hours); if (minutes != 0 || seconds != 0) { len += sprintf(result + len, ":%02d", minutes); -- 2.52.0

2 1

[PROPOSED] zic now checks for signals more often
by Paul Eggert March 17, 2026

March 17, 2026

* NEWS: Mention this. * zic.c (verror, make_links, main, get_rand_u64) (random_dirent, open_outfile, dolink, inputline, infile): Be better about checking for signals, e.g., when the input or the random number generator is giving is trouble, so that it’s easier for the user to control-C out. Although the result is not perfect it should be good enough for practical use. --- NEWS | 2 ++ zic.c | 35 ++++++++++++++++++++++------------- 2 files changed, 24 insertions(+), 13 deletions(-) diff --git a/NEWS b/NEWS index d4ba011b..fa791cb9 100644 --- a/NEWS +++ b/NEWS @@ -28,6 +28,8 @@ Unreleased, experimental changes which can occur with adversarial input. (Thanks to GitHub user rootvector2.) + zic now checks for signals more often. + Release 2026a - 2026-03-01 22:59:49 -0800 diff --git a/zic.c b/zic.c index 77396228..c0891001 100644 --- a/zic.c +++ b/zic.c @@ -253,6 +253,7 @@ symlink(char const *target, char const *linkname) (errno = ENOTSUP, -1) #endif +static void check_for_signal(void); static void addtt(zic_t starttime, int type); static int addtype(zic_t, char const *, bool, bool, bool); static void leapadd(zic_t, int, int); @@ -704,6 +705,7 @@ eat(int fnum, lineno num) ATTRIBUTE_FORMAT((printf, 1, 0)) static void verror(const char *const string, va_list args) { + check_for_signal(); /* ** Match the format of "cc" to allow sh users to ** zic ... 2>&1 | error -t "*" -v @@ -1074,6 +1076,7 @@ make_links(void) warning(_("link %s targeting link %s"), links[i].l_linkname, links[i].l_target); } + check_for_signal(); } } @@ -1391,6 +1394,7 @@ main(int argc, char **argv) for (j = i + 1; j < nzones && zones[j].z_name == NULL; ++j) continue; outzone(&zones[i], j - i); + check_for_signal(); } make_links(); if (lcltime != NULL) { @@ -1486,9 +1490,11 @@ get_rand_u64(void) static int nwords; if (!nwords) { ssize_t s; - do + for (;; check_for_signal()) { s = getrandom(entropy_buffer, sizeof entropy_buffer, 0); - while (s < 0 && errno == EINTR); + if (! (s < 0 && errno == EINTR)) + break; + } nwords = s < 0 ? -1 : s / sizeof *entropy_buffer; } @@ -1516,7 +1522,7 @@ get_rand_u64(void) rmod = INT_MAX < UINT_FAST64_MAX ? 0 : UINT_FAST64_MAX / nrand + 1, r = 0, rmax = 0; - do { + for (;; check_for_signal()) { uint_fast64_t rmax1 = rmax; if (rmod) { /* Avoid signed integer overflow on theoretical platforms @@ -1527,7 +1533,9 @@ get_rand_u64(void) rmax1 = nrand * rmax1 + rand_max; r = nrand * r + rand(); rmax = rmax < rmax1 ? rmax1 : UINT_FAST64_MAX; - } while (rmax < UINT_FAST64_MAX); + if (UINT_FAST64_MAX <= rmax) + break; + } return r; } @@ -1574,9 +1582,11 @@ random_dirent(char const **name, char **namealloc) *name = *namealloc = dst; } - do + for (;; check_for_signal()) { r = get_rand_u64(); - while (unfair_min <= r); + if (r < unfair_min) + break; + } for (i = 0; i < suffixlen; i++) { dst[dirlen + prefixlen + i] = alphabet[r % alphabetlen]; @@ -1611,7 +1621,7 @@ open_outfile(char const **outname, char **tempname) if (!*tempname) random_dirent(outname, tempname); - while (true) { + for (;; check_for_signal()) { int oflags = O_WRONLY | O_BINARY | O_CREAT | O_EXCL; int fd = open(*outname, oflags, creat_perms); int err; @@ -1725,8 +1735,6 @@ dolink(char const *target, char const *linkname, bool staysymlink) char const *outname = linkname; int targetissym = -2, linknameissym = -2; - check_for_signal(); - if (strcmp(target, "-") == 0) { if (remove(linkname) == 0 || errno == ENOENT || errno == ENOTDIR) return; @@ -1739,7 +1747,7 @@ dolink(char const *target, char const *linkname, bool staysymlink) } } - while (true) { + for (;; check_for_signal()) { if (linkat(AT_FDCWD, target, AT_FDCWD, outname, AT_SYMLINK_FOLLOW) == 0) { link_errno = 0; @@ -1791,7 +1799,7 @@ dolink(char const *target, char const *linkname, bool staysymlink) int symlink_errno = -1; if (contents) { - while (true) { + for (;; check_for_signal()) { if (symlink(contents, outname) == 0) { symlink_errno = 0; break; @@ -1822,7 +1830,7 @@ dolink(char const *target, char const *linkname, bool staysymlink) exit(EXIT_FAILURE); } tp = open_outfile(&outname, &tempname); - while ((c = getc(fp)) != EOF) + for (; (c = getc(fp)) != EOF; check_for_signal()) putc(c, tp); close_file(tp, directory, linkname, tempname); close_file(fp, directory, target, NULL); @@ -1946,7 +1954,7 @@ static bool inputline(FILE *fp, char *buf, ptrdiff_t bufsize) { ptrdiff_t linelen = 0, ch; - while ((ch = getc(fp)) != '\n') { + for (; (ch = getc(fp)) != '\n'; check_for_signal()) { if (ch < 0) { if (ferror(fp)) { error(_("input error")); @@ -2033,6 +2041,7 @@ infile(int fnum, char const *name) default: unreachable(); } } + check_for_signal(); } close_file(fp, NULL, filename(fnum), NULL); if (wantcont) -- 2.51.0

1 0

[PROPOSED] Fix zic buffer overflow when computing TZ
by Paul Eggert March 17, 2026

March 17, 2026

Problem reported by GitHub user rootvector2. * NEWS: Mention this. * zic.c (outzone): Increase envvar len max. --- NEWS | 5 +++++ zic.c | 6 +++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 905a086d..d4ba011b 100644 --- a/NEWS +++ b/NEWS @@ -23,6 +23,11 @@ Unreleased, experimental changes zic no longer mishandles a last transition to a new time type. + zic no longer overflows a buffer when generating a TZ string like + "PST-167:59:58PDT-167:59:59,M11.5.6/-167:59:59,M12.5.6/-167:59:59", + which can occur with adversarial input. (Thanks to GitHub + user rootvector2.) + Release 2026a - 2026-03-01 22:59:49 -0800 diff --git a/zic.c b/zic.c index 225ad419..77396228 100644 --- a/zic.c +++ b/zic.c @@ -3416,12 +3416,16 @@ outzone(const struct zone *zpfirst, ptrdiff_t zonecount) int nonTZlimtype = -1; zic_t max_year0; int defaulttype = -1; + int max_stringoffset_len = sizeof "-167:59:59" - 1; + int max_comma_stringrule_len = (sizeof ",M12.5.6/" - 1 + + max_stringoffset_len); check_for_signal(); /* This cannot overflow; see FORMAT_LEN_GROWTH_BOUND. */ max_abbr_len = 2 + max_format_len + max_abbrvar_len; - max_envvar_len = 2 * max_abbr_len + 5 * 9; + max_envvar_len = 2 * (max_abbr_len + max_stringoffset_len + + max_comma_stringrule_len); startbuf = xmalloc(max_abbr_len + 1); ab = xmalloc(max_abbr_len + 1); -- 2.51.0

1 0

Request to delay America/Vancouver tm_isdst transition until November
by Robert Bastian March 11, 2026

March 11, 2026

The change in 8b46071 <https://github.com/eggert/tz/commit/8b46071fd85a7a9434d63894bac64d30362cc16d> sets America/Vancouver's tm_isdst flag to false starting this Monday. Because CLDR keys its display names by this flag, this change will cause ICU and other downstream software (including major operating systems) to display BC’s UTC-7 as "Pacific Standard Time," while Los Angeles’ UTC-7 will display as "Pacific Daylight Time." The CLDR and ICU Technical Committees have evaluated several immediate paths forward, including new display names or a generic "UTC-7" (both of which are not sensitive to the tm_isdst value). However, due to the tight timeline (CLDR releases don't propagate as quickly as TZDB releases), and the uncertainty around the name that will actually be used in the real world, we have determined that continuing to use "Pacific Daylight Time" through this summer is the least confusing solution for users, as it maintains alignment across the Pacific Time corridor until BC actually diverges in November. To support this, we ask that the change to the tm_isdst flag be delayed until November, at least in the rearguard version of the TZDB. This will give us time to determine the name that people will be using, remodel CLDR's data, acquire translations, and ship a release to devices. Best regards, Robert *(On behalf of the CLDR/ICU Technical Committees)*

12 40

Add Asia/Novosibirsk as a separate timezone entry
by Tomon_1 March 10, 2026

March 10, 2026

Hello, I would like to propose adding *Asia/Novosibirsk* as a separate canonical entry in the tz database, currently it is grouped under *Asia/Krasnoyarsk* (UTC+7). Novosibirsk is the third largest city in Russia with a population of 1.6 million people. While both cities currently share UTC+7, Novosibirsk has a distinct historical timeline. It was on UTC+6 (MSK+3) from 1993 to 2016, while Krasnoyarsk remained on UTC+7 during that period. This means their clocks disagreed for over 20 years. Having a separate Asia/Novosibirsk entry would better represent the Novosibirsk region's identity and its distinct timezone history, and would benefit millions of users in the region who currently see "Krasnoyarsk" displayed as their timezone. Thank you for considering this proposal.

2 1

British Columbia
by Arthur Olson March 9, 2026

March 9, 2026

B. C. Gov News: "Adopting permanent daylight saving time: ‘Spring forward’ on March 8 will be the last time change, ending twice-yearly clock changes." https://news.gov.bc.ca/releases/2026AG0013-000209 @dashdashado

15 32

Summer time transitions in Moldova
by Heitor David Pinto March 9, 2026

March 9, 2026

Soviet Moldovan resolution 132 of 1990 defined the summer time period from the last Sunday in March at 2:00 to the last Sunday in September at 3:00, matching the dates used in most of Europe at the time: https://web.archive.org/web/20211107050832/http://lex.justice.md/viewdoc.ph… It seems that in 1996 Moldova changed the end date to October like most of Europe, but kept the transitions at 2:00 and 3:00 rather than 1:00 UTC, which would have been locally 3:00 and 4:00. The TZ database currently shows Moldova with the transitions at 2:00 and 3:00 since 1997. The notices in the Moldovan government website and broadcaster showed the transitions at 2:00 and 3:00 until 2021: 2015 https://old.gov.md/en/node/7304 2016 https://old.gov.md/en/node/12587 2017 https://old.gov.md/en/node/20654 2017 https://old.gov.md/en/content/moldova-upholds-winter-time-night-28-29-octob… 2018 https://old.gov.md/en/content/moldova-switch-summer-time 2018 https://old.gov.md/en/content/cabinet-ministers-informs-about-switch-winter… 2019 https://old.gov.md/en/content/moldova-switch-summer-time-31-march 2019 https://old.gov.md/en/node/31122 2020 https://old.gov.md/en/node/32771 2020 https://old.gov.md/en/node/34497 2021 https://trm.md/ro/social/moldova-trece-in-aceasta-noapte-la-ora-de-vara 2021 https://trm.md/en/social/republica-moldova-trece-la-ora-de-iarna1 However, since 2022, the notices showed the transitions at 3:00 and 4:00, matching the EU rule at 1:00 UTC: 2022 https://trm.md/en/social/in-acest-weekend-republica-moldova-trece-la-ora-de… 2022 https://old.gov.md/en/content/moldova-switch-winter-time 2023 https://moldova1.md/p/6587/ora-de-vara-2023-cum-schimbam-acele-ceasornicelo… 2023 https://old.gov.md/en/node/46662 2024 https://moldova1.md/p/26535/republica-moldova-trece-la-ora-de-vara-in-acest… 2024 https://moldova1.md/p/37768/republica-moldova-trece-in-aceasta-noapte-la-or… 2025 https://moldova1.md/p/46349/republica-moldova-trece-la-ora-de-vara-pe-30-ma… 2025 https://moldova1.md/p/60469/republica-moldova-trece-la-ora-de-iarna-ceasuri… It seems that the changes to the end date and transition times were just done in practice without formally changing the resolution. In late 2025, the government said that the Soviet resolution was still in force, and proposed a new resolution to replace it and formally establish the EU rule: https://particip.gov.md/ro/document/stages/anunt-de-initiere-a-proiectului-… https://gov.md/sites/default/files/media/documents/sedinte-de-guvern/2026-0… It plans to approve the proposed resolution on 25 February 2026: https://gov.md/en/node/9683 However, based on the notices, it seems that in practice Moldova already uses the EU rule since 2022. This was also the year when Moldova applied to join the EU. Regards, David

7 8

An appearance in the New York Times
by Arthur Olson March 9, 2026

March 9, 2026

(Spoiler ahead) The (pay-walled) New York Times "Strands" puzzle for 2026-03-08 includes what folks on this list will recognize as a singular error. https://www.nytimes.com/games/strands @dashdashado

1 0

[PROPOSED] zic: keep needed last transition to new type
by Paul Eggert March 7, 2026

March 7, 2026

* NEWS: Mention this. * zic.c (outzone): Omit an incorrect use of ‘useuntil’. This fixes a bug in 2023-10-15’s “Fix zic bug with Palestine after 2075” (commit 35c116b7536a36c43eb7cd36bff71ad0c5ecf071), which caused zic to mess up if the last transition is to a new time type. This patch does not affect any TZif files generated by current tzdata. This artificial input illustrates the bug: Rule Canada 2007 max - Mar Sun>=8 2:00 1:00 D Rule Canada 2007 max - Nov Sun>=1 2:00 0 S Zone America/Vancouver -8:00 - PST 2026 Mar 9 -8:00 Canada P%sT 2026 Nov 1 02:00 -7:00 - MST Without the fix, zic generates a nonconforming TZif file that omits the last transition even though the trailing TZ string is "MST7". --- NEWS | 7 +++++++ zic.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 267e62da..d7bf5a3c 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ News for the tz database Unreleased, experimental changes + Briefly: + British Columbia moves to permanent -07 on 2026-03-09. + Changes to future timestamps British Columbia's 2026-03-08 spring forward will be its last @@ -12,6 +15,10 @@ Unreleased, experimental changes a limitation in CLDR v48.1 (2026-01-08). This temporary hack is planned to be removed after CLDR is fixed. + Changes to code + + zic no longer mishandles a last transition to a new time type. + Release 2026a - 2026-03-01 22:59:49 -0800 diff --git a/zic.c b/zic.c index c10be426..225ad419 100644 --- a/zic.c +++ b/zic.c @@ -3522,7 +3522,7 @@ outzone(const struct zone *zpfirst, ptrdiff_t zonecount) startttisut); if (usestart) { addtt(starttime, type); - if (useuntil && nonTZlimtime < starttime) { + if (nonTZlimtime < starttime) { nonTZlimtime = starttime; nonTZlimtype = type; } -- 2.51.0

1 0

[PATCH] Cite recent review of DST and sleep
by Paul Eggert March 6, 2026

March 6, 2026

* tz-link.html (Costs and benefits of time shifts): Also cite Romigi, Franco, Scoditti et al 2025. Clean up some other HTML and wording. --- tz-link.html | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/tz-link.html b/tz-link.html index f19f9aab..5f1989f0 100644 --- a/tz-link.html +++ b/tz-link.html @@ -289,7 +289,7 @@ community, and data distributors downstream. If your government plans to change its time zone boundaries or daylight saving rules, please send email as described in -"<a href="#changes">Changes to the <code><abbr>tz</abbr></code> database</a>". +“<a href="#changes">Changes to the <code><abbr>tz</abbr></code> database</a>”. Do this well in advance, as this will lessen confusion and will coordinate updates to many cell phones, computers, and other devices around the world. @@ -966,11 +966,17 @@ subtropical regions consume more electricity because of <abbr>DST</abbr>.”</li <li>Neumann P, von Blanckenburg K. <a href="https://journals.sagepub.com/doi/full/10.1177/0961463X241310562">What time will it be? A comprehensive literature review on daylight saving time</a>. -Time Soc. 2025-01-21. +Time Soc. 2025;34(4):684–745. doi:<a href="https://doi.org/10.1177/0961463X241310562">10.1177/0961463X241310562</a>. -This reviews DST’s effects on electricity, health, crime, road safety, -and the economy, focusing on research since 2010, and concludes that -year-round standard time is preferable overall. +This reviews <abbr>DST</abbr>’s effects on electricity, health, crime, road +safety, and the economy, focusing on research since 2010, and concludes that +year-round standard time is preferable overall.</li> +<li>Romigi A, Franco V, Scoditti E et al. +The effects of daylight saving time and clock time transitions on sleep and +sleepiness: a systematic review. Sleep Med Rev. 2025;84:102161. doi:<a +href="https://doi.org/10.1016/j.smrv.2025.102161">10.1016/j.smrv.2025.102161</a>. +This reviews <abbr>DST</abbr> and <abbr>DST</abbr> transitions, +and concludes that they both harm sleep, health and behavior.</li> </ul> The following medical societies have taken positions on the @@ -985,7 +991,7 @@ supporting permanent standard time</a> on health grounds.</li> British Sleep Society position statement on Daylight Saving Time in the UK</a>. J Sleep Res. 2025;34(3):e14352. doi:<a href="https://doi.org/10.1111/jsr.14352">10.1111/jsr.14352</a>. -This recommends that the UK abolish DST for health reasons.</li> +This recommends that the UK abolish <abbr>DST</abbr> for health reasons.</li> <li>Malow BA. <a href="https://academic.oup.com/sleep/article/45/12/zsac236/6717940">It is time to abolish the clock change and adopt permanent @@ -993,7 +999,7 @@ standard time in the United States: a Sleep Research Society position statement</a>. Sleep. 2022;45(12):zsac236. doi:<a href="https://doi.org/10.1093/sleep/zsac236">10.1093/sleep/zsac236</a>. -After reviewing the scientific literature, the Sleep Research Society +The Sleep Research Society advocates permanent standard time due to its health benefits.</li> <li>Rishi MA, Cheng JY, Strang AR et al. <a href="https://jcsm.aasm.org/doi/10.5664/jcsm.10898">Permanent standard time -- 2.51.0

9 16