November 2022 - tz - lists.iana.org

[tz-announce] 2022g release of tz code and data available
by Paul Eggert via tz-announce Nov. 29, 2022

Nov. 29, 2022

The 2022g release of the tz code and data is available. This release contains the following changes: Briefly: The northern edge of Chihuahua changes to US timekeeping. Much of Greenland stops changing clocks after March 2023. Fix some pre-1996 timestamps in northern Canada. C89 is now deprecated; please use C99 or later. Portability fixes for AIX, libintl, MS-Windows, musl, z/OS In C code, use more C23 features if available. C23 timegm now supported by default Fixes for unlikely integer overflows Changes to future timestamps In the Mexican state of Chihuahua, the border strip near the US will change to agree with nearby US locations on 2022-11-30. The strip's western part, represented by Ciudad Juárez, switches from -06 all year to -07/-06 with US DST rules, like El Paso, TX. The eastern part, represented by Ojinaga, will observe US DST next year, like Presidio, TX. (Thanks to Heitor David Pinto.) A new Zone America/Ciudad_Juarez splits from America/Ojinaga. Much of Greenland, represented by America/Nuuk, stops observing winter time after March 2023, so its daylight saving time becomes standard time. (Thanks to Jonas Nyrup and Jürgen Appel.) Changes to past timestamps Changes for pre-1996 northern Canada (thanks to Chris Walton): Merge America/Iqaluit and America/Pangnirtung into the former, with a backward compatibility link for the latter name. There is no good evidence the two locations differ since 1970. This change affects pre-1996 America/Pangnirtung timestamps. Cambridge Bay, Inuvik, Iqaluit, Rankin Inlet, Resolute and Yellowknife did not observe DST in 1965, and did observe DST from 1972 through 1979. Whitehorse moved from -09 to -08 on 1966-02-27, not 1967-05-28. Colombia's 1993 fallback was 02-06 24:00, not 04-04 00:00. (Thanks to Alois Treindl.) Singapore's 1981-12-31 change was at 16:00 UTC (23:30 local time), not 24:00 local time. (Thanks to Geoff Clare via Robert Elz.) Changes to code Although tzcode still works with C89, bugs found in recent routine maintenance indicate that bitrot has set in and that in practice C89 is no longer used to build tzcode. As it is a maintenance burden, support for C89 is planned to be removed soon. Instead, please use compilers compatible with C99, C11, C17, or C23. timegm, which tzcode implemented in 1989, will finally be standardized 34 years later as part of C23, so timegm is now supported even if STD_INSPIRED is not defined. Fix bug in zdump's tzalloc emulation on hosts that lack tm_zone. (Problem reported by Đoàn Trần Công Danh.) Fix bug in zic on hosts where malloc(0) yields NULL on success. (Problem reported by Tim McBrayer for AIX 6.1.) Fix zic configuration to avoid linkage failures on some platforms. (Problems reported by Gilmore Davidson and Igor Ivanov.) Work around MS-Windows nmake incompatibility with POSIX. (Problem reported by Manuela Friedrich.) Port mktime and strftime to debugging platforms where accessing uninitialized data has undefined behavior (strftime problem reported by Robert Elz). Check more carefully for unlikely integer overflows, preferring C23 <stdckdint.h> to overflow checking by hand, as the latter has had obscure bugs. Changes to build procedure New Makefile rule check_mild that skips checking whether Link lines are in the file 'backward'. (Inspired by a suggestion from Stephen Colebourne.) Here are links to the release files: https://www.iana.org/time-zones/repository/releases/tzcode2022g.tar.gz https://www.iana.org/time-zones/repository/releases/tzdata2022g.tar.gz https://www.iana.org/time-zones/repository/releases/tzdb-2022g.tar.lz The following convenience links are also available, although they may point to the previous release until the relevant caches are refreshed: https://www.iana.org/time-zones/repository/tzcode-latest.tar.gz https://www.iana.org/time-zones/repository/tzdata-latest.tar.gz https://www.iana.org/time-zones/repository/tzdb-latest.tar.lz Links are also available via plain HTTP, and via FTP from ftp://ftp.iana.org/tz/releases with the same basenames as above. Each release file has a GPG signature, which can be retrieved by appending ".asc" to the above URLs. Copies of these signatures are appended to this message. This release corresponds to commit 4e604e41115182c3ab1185bab4c888822511348e dated 2022-11-29 08:58:31 -0800 and tagged '2022g' in the development GitHub repository at <https://github.com/eggert/tz>. Here are the SHA-512 checksums for the release files: 5188edd8d05238a88da734cf78fadfb57640d4db3e7a0a9dddd70e3071e16b6eebc2e2ab17109b7dafafae68abfbc857df481cfdc3ffe63f7eb1569ea0b5997a tzcode2022g.tar.gz 7f79394295e00e3a24ebdbf9af3bc454a65f432a93b517e7e96c7f9db9949f6f5fdae9892a9d3789ff44ae0eb1bfe4744d36976b4624659af951d26414f94e65 tzdata2022g.tar.gz f471046189f519de5735ac2d8c3edb27cbe925247b06f44634e700e5e4453ec5f715d85256fc74d300bcdaa070a7600fcc054327f2dfe743ab3c0fe404ff83c1 tzdb-2022g.tar.lz Here are the GPG digital signatures for the release files: -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEfjeSqdis99YzvBWI7ZfpDmKqfjQFAmOGOvAACgkQ7ZfpDmKq fjSI4w/+PkVPCILI34+QeXIm6LLPhEPLxtb7q3rvfoBXk/qyottcPJvQXSAsqX/c Hus6lCNK0COyICVn48rf3ss+GNxLev/ZTMVLUBkH8WrgSe+5lPDjmaZjkbzIGPs8 L9TqE60K8DyeLNnZPf4Pkpx6o5r7uO3iQSN5qFyj5H82mDJ4vcQLZSNvDIA4+sRm +qmsBcn6Gk3EU3u3/YrxhuEY0ymUrJvm5LSG62CqLwA1Pd+REF70Ir5LdO4yJoUS blWe/CLUcnRfzMEK9/NGa1z3GtkisPYBCPnYJ93m2n4ASvFQ+R3t7NCEY2W+96ce 3kSPIX5W2g0/gcDTi1bxdLnQkO4RxtSQnlCjCae58dQNUgOa2X8mdRniRjjYC059 JY35VUzmX9wCPpcuq0iMbpOEWXeWga0ZDRmlZtZCwPKxkw+AhoJQVp5jxGNa4kwZ CZDjQga3ObvN8aQqMi9TpabJ4m2ZdN1yHQ7OTN80N67tHYMAbW0aY3J0JRIVjTHo P+8Y6FaCLzJA73BgnR7faiILXIPtXE54X+koo8x2Uwtrl8/wHsaPTippq96ts6Y6 3Zdr3EAQgAPhYtUgtHoIbLFBLjmyL5sUXOTwG/gMkUYXVkDpeBnc+BHrkv0Sjaw7 Vzz5HthhnSblP9bLB3KPTbbM0t+aypsSOYOSZWnIK8ANI9BdrNQ= =tSyt -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEfjeSqdis99YzvBWI7ZfpDmKqfjQFAmOGOvAACgkQ7ZfpDmKq fjSedhAAu8XkzqB8NmXDYfEurBCUPe7zCBxBe7yqdt5W+tDA9snOtab3d8Oq7Lsb vNZfh4qHIxNbEYpoXOc0Qce3XKXGgyKDmZeFYQJ0ziqoZXetNLQEmg7T/H2m3GHl eo7K3w2hvyBB26FuDtimE5pzuJo9qJLXDp2SbOAbKa1w5HibyvZBOfcQozZ4CBmE mBc8LzyFY3zOhiy7CGYskqOzatNa0Eid95RkK2RXXTnN965N1qdyOz3z9SkJFH9h MR84VGYBmk0UGdPGmp1imkGmIrO/8AFny19ECCe4F74o2DFSPzANOaEh+i3fIP3d GNR96la9GGopmna+VNQt6zxdw4DHRoNkAupnJ2NVM0lbAMOG0mmwCFkCzW4gzTVm 7NdAtZyH+HjiKYPdQNIHbsvl0K1qIo1yXrb4jTd8eXaxA65msCOOwjqWk7a8ZjrJ NrLNmGeLow9svofEAeLpc9BUgwF90JGIlb+tPYovyj/xSU9vhQl1ZEmFYYdaN781 rGZ5jKtwBZWoAxW1Copf8S3jcxleSVMFo6MTEU+K+svZLd8SH5BnETa0fYWSTzKA uh2Y4V6pFe0/JVVC15mYkytbP6TC6prRmi44jRHtVRDtizGd7FFxYacIApkhBVi2 Qb8Qy+oZySwL+dbRlu+bA9nHIdACtxRouVEWpAecCBLaK3kBb7I= =6g+2 -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEfjeSqdis99YzvBWI7ZfpDmKqfjQFAmOGOvIACgkQ7ZfpDmKq fjT6/A/5AQdjRCEQngohVPQcxWE57FhHN+3Yq72iCbi64MhnL8sR+fHcni8CRb4f SIxi/tXeLdKJVV8+w7TBeQIDBDHrWXla2NSTHNcGREdp/wMoWagxBzAx3g2qQ7eT Qz6JhG4pHlOGK3u0/RESuCnhS/XmKTYj6BeDNc33LQ4iB0Lh+o9O/rz6jQyO3Y3L 84QMNJ4Edq/pOz9d9T1/cWO1j8Cn4Mled9WdCyOqZnhzRcJdbi/gDydC5aJIj1Fx 5OUrRwblIRVxMbK+kZA4D0lHR56KZb7NsaFGfsnW0m5zHUpXoGNYaFelKlWoRblO OEneM34IgNxsLhe9J9r/epSWB/14PmaY0zdXlNmKqELa7zYiJkiAwucPWtpxkPJG q6WPt4Pk4bWcud9esdgG7vjBz3ffrz2hUrmSMxuwLPHLuPRLrBoeMAmecFixGpea BUmR+XCPV9m19zcnvshBFGuLTNwFZSWBlUB9lWIocXc9cIMo4W/gNdUhnjb9L0+z VtAJzws1VcRV5zpkanwt+K50xjUlunxcRgLbLY2oMCpeDQyxH6DTnUr8RdJeMmvM ZPJYekxG0W8/eEjDOUFIQqvOtK1sQVhCZhjeciDW7to/K1p7DJy+g5g7lJn5KK4B Oz8vqmhdvdoIAK5uezPILpyJT7UpdUhmZ1WwQRqhk6G3jXPigQc= =Kyhr -----END PGP SIGNATURE-----

1 0

America/Nuuk changes from UTC-2 to UTC-2
by Jonas Nyrup Nov. 29, 2022

Nov. 29, 2022

On last Saturday in October 2023 when DST ends America/Nuuk will switch from -03/-02 to -02/-01 https://sermitsiaq.ag/forslagtidsforskel-danmark-mindskes-sommertid-beholdes describes the proposed bill about switching from UTC-3 to UTC-2 and that is not about abolishing DST as they do not want to make a decision on that matter before the rest of EU. https://sermitsiaq.ag/groenland-skifte-tidszone-trods-bekymringer writes that on November 24th 2022 the Parliament of Greenland approved the bill and that *the bill* will take effect on March 25th 2023 at 22:00 when DST begins. Both articles translates well with Google Translate. Inatsisartut = the Parliament of Greenland Naalakkersuisut = the government of Greenland I assume the official document will be published on https://naalakkersuisut.gl/kundgoerelser/2022?sc_lang=da Best regards Jonas Nyrup

2 2

[PROPOSED 0/5] Finish off support for C23 standard attributes
by Paul Eggert Nov. 28, 2022

Nov. 28, 2022

The attached patches update tzcode to use the remaining C23 standard attributes that look useful for tzcode. I don't see any tzcode use for the C23 attributes 'deprecated' and 'nodiscard'. Paul Eggert (5): Use C23 [[noreturn]] if available Pacify gcc -std=c89 -pedantic with new attributes Use C23 [[reproducible]] if available. Use C23 [[unsequenced]] if available Use C23 [[fallthrough]] if available Makefile | 2 +- date.c | 2 +- localtime.c | 4 +-- private.h | 77 ++++++++++++++++++++++++++++++++++++++++++++--------- zdump.c | 10 +++---- zic.c | 32 +++++++++++----------- 6 files changed, 90 insertions(+), 37 deletions(-) -- 2.37.2

2 7

Doubts about a typo fix
by Alejandro Colomar Nov. 26, 2022

Nov. 26, 2022

Hi Paul, I don't undertstand the commit shown below. It breaks the '-' symbol, which now is a hyphen. See the table mentioned yesterday: ┌──────────────────────────────────────────────────────────────────┐ │Keycap Appearance and meaning Special character and meaning │ ├──────────────────────────────────────────────────────────────────┤ │" " neutral double quote \[dq] neutral double quote │ │' ’ closing single quote \[aq] neutral apostrophe │ │- ‐ hyphen \- or \[-] minus sign/Unix dash │ │\ (escape character) \e or \[rs] reverse solidus │ │^ ˆ modifier circumflex \(ha circumflex/caret/“hat” │ │` ‘ opening single quote \(ga grave accent │ │~ ˜ modifier tilde \(ti tilde │ └──────────────────────────────────────────────────────────────────┘ So, at least, it should be (but I believe the initial code was correct): .q "zic \*\-r @$(date +%s)" However, I wonder what that \* is intending to do there (I can see no difference in my screen with or without it). Cheers, Alex --- commit 918e10e8963b3c0d38d3b5fb8ec9cf08ecd03757 Author: Paul Eggert <eggert(a)cs.ucla.edu> Date: Tue Jul 12 06:26:53 2022 -0700 * zic.8: fix minus typo diff --git a/zic.8 b/zic.8 index 0cd0781e..e8816e5b 100644 --- a/zic.8 +++ b/zic.8 @@ -145,7 +145,7 @@ .SH OPTIONS 31-bit signed integers. On platforms with GNU .BR date , -.q "zic \-r @$(date +%s)" +.q "zic \*-r @$(date +%s)" omits data intended for past timestamps. Although this option typically reduces the output file's size, the size can increase due to the need to represent the timestamp range -- <http://www.alejandro-colomar.es/>

5 7

New law about Time and Time zones in Greenland
by Jürgen Appel Nov. 25, 2022

Nov. 25, 2022

Dear all, i was made aware that on Thursday, 2022-11-24, a law proposal concerning time and time zones for Greenland was voted upon in Greenland Parliament: Reference (in Danish and Greenlandic): https://ina.gl/samlinger/oversigt-over-samlinger/samling/dagsordener/ dagsorden.aspx?lang=da&day=24-11-2022 https://ina.gl/media/2553527/pkt17_em2022_tidens_-bestemmelse_lov_da.pdf Translated with www.DeepL.com/Translator and annotated: =====[Proposal]===== Inatsisartut (Parliament of Greenland) Act on the Regulation of Time § 1. The standard time for Greenland shall be UTC -2. Clause 2. Naalakkersuisut (the Cabinet of Greenland) may establish rules that specified areas shall follow a different time zone than that determined in paragraph 1. Clause 3. Naalakkersuisut may establish rules on summer time. § 2. This Inatsisartut Act shall enter into force on 25 March 2023 at 22:00. Clause 2. At the same time, Landstingslov nr. 14 of 19 October 1989 regarding the application of summer time is repealed. Greenland Self-Government, x. xx xxx The President of Naalakkersuisut =================== If I understand this correctly, from the next planned switch to summer time, Greenland will permanently stay at that time, i.e. no switch back to winter time in 2023 will occur. Whether a switch to a shifted summer time will occur in spring 2024 is not completely transparent to me, as in some remarks (https://ina.gl/media/ 2554772/pkt17_em2022_tidens_bestemmelse_bet_2beh_da.pdf) it is written that no changes in the summer time regulations will be applied, and that this will occur only after EU has decided about the same topic. If some danish native speaker, or better yet someone from Greenland could confirm/clarify this, that would be nice. Also concerning "specified areas", i.e. today Ittoqqortoormiit (now UTC -1), Danmarkshavn (UTC +0), and Pituffik/Thule Air Base (UTC-4), I am unsure whether any changes are scheduled or whether the cabinet plans to keep/ reestablish the current rules. Best regards, Jürgen Appel -- Jürgen Appel Senior Scientist Denmark's National Metrology Institute Dansk Fundamental Metrologi, DFM A/S (dfm.dk) Kogle Allé 5 DK-2970 Hørsholm Denmark Mobile: +45 25459049 Email: jap(a)dfm.dk VAT: DK-29217939

2 1

Re: [tz] [PATCH v2 1/4] zic.8: Add public domain notice
by Brian Inglis Nov. 25, 2022

Nov. 25, 2022

On 2022-11-23 11:32, Paul Eggert via tz wrote: > The file already contains a public-domain notice at the bottom, in a > human-readable format that is visible to anybody who looks at the printable > version of the man page. No public domain notices appear in the *.?.txt source files or in the generated man pages. It may be useful to specify that the document, data, program, and source files for all components are in the public domain in the LICEN[CS]E sections. It would also be useful if you also added SPDX licence comments like man-pages after either your line(s) or theirs, such as: .\" SPDX-License-Identifier: LicenseRef-IANA-TZ-Public-Domain [suggested] .\" SPDX-FileCopyrightText: project authors [suggested] and also in the generated output?, as it may save downstreams doing so as licensing requirements are enforced by packaging tools and repos. -- Take care. Thanks, Brian Inglis Calgary, Alberta, Canada La perfection est atteinte Perfection is achieved non pas lorsqu'il n'y a plus rien à ajouter not when there is no more to add mais lorsqu'il n'y a plus rien à retirer but when there is no more to cut -- Antoine de Saint-Exupéry

2 1

[PROPOSED] Use C23 [[maybe_unused]] if available
by Paul Eggert Nov. 21, 2022

Nov. 21, 2022

* Makefile (GCC_DEBUG_FLAGS): Omit -Wno-unused-parameters, as the code is now safe for gcc -Wunused-parameters. * private.h (ATTRIBUTE_MAYBE_UNUSED): New macro. * localtime.c (gmtsub): * strftime.c (strftime_l) [HAVE_STRFTIME_L]: * zdump.c (gmtoff): Use it to mark possibly-unused parameters. * zdump.c (hunt): * zic.c (getleapdatetime): Omit unused arg. All callers changed. --- Makefile | 2 +- localtime.c | 4 ++-- private.h | 13 +++++++++++++ strftime.c | 2 +- zdump.c | 13 +++++++------ zic.c | 6 +++--- 6 files changed, 27 insertions(+), 13 deletions(-) diff --git a/Makefile b/Makefile index 92d78cb4..b2c6ff6f 100644 --- a/Makefile +++ b/Makefile @@ -300,7 +300,7 @@ GCC_DEBUG_FLAGS = -DGCC_LINT -g3 -O3 -fno-common \ -Wtrampolines -Wundef -Wuninitialized -Wunused-macros -Wuse-after-free=3 \ -Wvariadic-macros -Wvla -Wwrite-strings \ -Wno-address -Wno-format-nonliteral -Wno-sign-compare \ - -Wno-type-limits -Wno-unused-parameter + -Wno-type-limits # # If your system has a "GMT offset" field in its "struct tm"s # (or if you decide to add such a field in your system's "time.h" file), diff --git a/localtime.c b/localtime.c index 7faa5d32..4dd9d259 100644 --- a/localtime.c +++ b/localtime.c @@ -1662,8 +1662,8 @@ localtime_r(const time_t *timep, struct tm *tmp) */ static struct tm * -gmtsub(struct state const *sp, time_t const *timep, int_fast32_t offset, - struct tm *tmp) +gmtsub(ATTRIBUTE_MAYBE_UNUSED struct state const *sp, time_t const *timep, + int_fast32_t offset, struct tm *tmp) { register struct tm * result; diff --git a/private.h b/private.h index 4d40582e..fee18cb2 100644 --- a/private.h +++ b/private.h @@ -433,6 +433,19 @@ typedef unsigned long uintmax_t; # define ATTRIBUTE_FORMAT(spec) /* empty */ #endif +#ifdef __has_c_attribute +# if __has_c_attribute(__maybe_unused__) +# define ATTRIBUTE_MAYBE_UNUSED [[__maybe_unused__]] +# endif +#endif +#ifndef ATTRIBUTE_MAYBE_UNUSED +# if 2 < __GNUC__ + (7 <= __GNUC_MINOR__) +# define ATTRIBUTE_MAYBE_UNUSED __attribute__ ((__unused__)) +# else +# define ATTRIBUTE_MAYBE_UNUSED /* empty */ +# endif +#endif + #if !defined _Noreturn && __STDC_VERSION__ < 201112 # if 2 < __GNUC__ + (8 <= __GNUC_MINOR__) # define _Noreturn __attribute__((__noreturn__)) diff --git a/strftime.c b/strftime.c index 9ea40fec..b23b6101 100644 --- a/strftime.c +++ b/strftime.c @@ -117,7 +117,7 @@ static char * _yconv(int, int, bool, bool, char *, char const *); #if HAVE_STRFTIME_L size_t strftime_l(char *s, size_t maxsize, char const *format, struct tm const *t, - locale_t locale) + ATTRIBUTE_MAYBE_UNUSED locale_t locale) { /* Just call strftime, as only the C locale is supported. */ return strftime(s, maxsize, format, t); diff --git a/zdump.c b/zdump.c index 89bcd25c..de1e1116 100644 --- a/zdump.c +++ b/zdump.c @@ -91,7 +91,7 @@ static bool errout; static char const *abbr(struct tm const *); static intmax_t delta(struct tm *, struct tm *) ATTRIBUTE_PURE; static void dumptime(struct tm const *); -static time_t hunt(timezone_t, char *, time_t, time_t, bool); +static time_t hunt(timezone_t, time_t, time_t, bool); static void show(timezone_t, char *, time_t, bool); static void showextrema(timezone_t, char *, time_t, struct tm *, time_t); static void showtrans(char const *, struct tm const *, time_t, char const *, @@ -627,7 +627,7 @@ main(int argc, char *argv[]) || (ab && (delta(&newtm, &tm) != newt - t || newtm.tm_isdst != tm.tm_isdst || strcmp(abbr(&newtm), ab) != 0))) { - newt = hunt(tz, argv[i], t, newt, false); + newt = hunt(tz, t, newt, false); newtmp = localtime_rz(tz, &newt, &newtm); newtm_ok = newtmp != NULL; if (iflag) @@ -707,7 +707,7 @@ yeartot(intmax_t y) return t; } -/* Search for a discontinuity in timezone TZ with name NAME, in the +/* Search for a discontinuity in timezone TZ, in the timestamps ranging from LOT through HIT. LOT and HIT disagree about some aspect of timezone. If ONLY_OK, search only for definedness changes, i.e., localtime succeeds on one side of the @@ -715,7 +715,7 @@ yeartot(intmax_t y) before the transition from LOT's settings. */ static time_t -hunt(timezone_t tz, char *name, time_t lot, time_t hit, bool only_ok) +hunt(timezone_t tz, time_t lot, time_t hit, bool only_ok) { static char * loab; static ptrdiff_t loabsize; @@ -807,7 +807,8 @@ adjusted_yday(struct tm const *a, struct tm const *b) my_gmtime_r and use its result instead of B. Otherwise, B is the possibly nonnull result of an earlier call to my_gmtime_r. */ static long -gmtoff(struct tm const *a, time_t *t, struct tm const *b) +gmtoff(struct tm const *a, ATTRIBUTE_MAYBE_UNUSED time_t *t, + ATTRIBUTE_MAYBE_UNUSED struct tm const *b) { #ifdef TM_GMTOFF return a->TM_GMTOFF; @@ -878,7 +879,7 @@ static void showextrema(timezone_t tz, char *zone, time_t lo, struct tm *lotmp, time_t hi) { struct tm localtm[2], gmtm[2]; - time_t t, boundary = hunt(tz, zone, lo, hi, true); + time_t t, boundary = hunt(tz, lo, hi, true); bool old = false; hi = (SECSPERDAY < hi - boundary ? boundary + SECSPERDAY diff --git a/zic.c b/zic.c index 8f8088ec..7a7a5094 100644 --- a/zic.c +++ b/zic.c @@ -1970,7 +1970,7 @@ inzsub(char **fields, int nfields, bool iscont) } static zic_t -getleapdatetime(char **fields, int nfields, bool expire_line) +getleapdatetime(char **fields, bool expire_line) { register const char * cp; register const struct lookup * lp; @@ -2048,7 +2048,7 @@ inleap(char **fields, int nfields) if (nfields != LEAP_FIELDS) error(_("wrong number of fields on Leap line")); else { - zic_t t = getleapdatetime(fields, nfields, false); + zic_t t = getleapdatetime(fields, false); if (0 <= t) { struct lookup const *lp = byword(fields[LP_ROLL], leap_types); if (!lp) @@ -2076,7 +2076,7 @@ inexpires(char **fields, int nfields) else if (0 <= leapexpires) error(_("multiple Expires lines")); else - leapexpires = getleapdatetime(fields, nfields, true); + leapexpires = getleapdatetime(fields, true); } static void -- 2.37.2

2 2

[PROPOSED] Prefer <stdckdint.h> for overflow checking
by Paul Eggert Nov. 20, 2022

Nov. 20, 2022

If <stdckdint.h> is available, or if its macros can be implemented easily, use the macros for overflow checking. This should help avoid future integer overflow bugs. * date.c (dogmt, timeout): * localtime.c (localsub, timesub, increment_overflow) (increment_overflow32, increment_overflow_time, time2sub): * zdump.c (sumsize, tzalloc): * zic.c (size_sum, size_product, grow_nitems_alloc, oadd, tadd): Prefer ckd_add etc. to doing overflow checking by hand. * private.h (HAVE_STDCKDINT_H): Default to true if __has_include(<stdckdint.h>). Include <stdckdint.h> if available. (ckd_add, ckd_sub, ckd_mul): Provide substitutes on recent-enough GCC-compatible compilers. --- Makefile | 2 ++ NEWS | 5 ++++- date.c | 10 ++++++++++ localtime.c | 33 +++++++++++++++++++++++++++++++++ private.h | 29 +++++++++++++++++++++++++++++ zdump.c | 12 ++++++++++++ zic.c | 31 +++++++++++++++++++++++++++++++ 7 files changed, 121 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 5ec0d4a..92d78cb 100644 --- a/Makefile +++ b/Makefile @@ -230,6 +230,8 @@ LDLIBS= # functions like 'link' or variables like 'tzname' required by POSIX # -DHAVE_SETENV=0 if your system lacks the setenv function # -DHAVE_SNPRINTF=0 if your system lacks the snprintf function +# -DHAVE_STDCKDINT_H=0 if neither <stdckdint.h> nor substitutes like +# __builtin_add_overflow work* # -DHAVE_STDINT_H=0 if <stdint.h> does not work* # -DHAVE_STRFTIME_L if <time.h> declares locale_t and strftime_l # -DHAVE_STRDUP=0 if your system lacks the strdup function diff --git a/NEWS b/NEWS index 7c46d3c..a401bee 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ News for the tz database Fix some pre-1996 timestamps in northern Canada. C89 is now deprecated; please use C99 or later. Portability fixes for AIX, libintl, MS-Windows, musl, z/OS + In C code, use more C23 features if available. C23 timegm now supported by default Fixes for unlikely integer overflows @@ -55,7 +56,9 @@ Unreleased, experimental changes uninitialized data has undefined behavior (strftime problem reported by Robert Elz). - Check more carefully for unlikely integer overflows. + Check more carefully for unlikely integer overflows, preferring + C23 <stdckdint.h> to overflow checking by hand, as the latter has + had obscure bugs. Changes to build procedure diff --git a/date.c b/date.c index cbc0ec1..1319462 100644 --- a/date.c +++ b/date.c @@ -122,8 +122,14 @@ dogmt(void) for (n = 0; environ[n] != NULL; ++n) continue; +#if defined ckd_add && defined ckd_mul + if (!ckd_add(&n, n, 2) && !ckd_mul(&n, n, sizeof *fakeenv) + && n <= SIZE_MAX) + fakeenv = malloc(n); +#else if (n <= min(PTRDIFF_MAX, SIZE_MAX) / sizeof *fakeenv - 2) fakeenv = malloc((n + 2) * sizeof *fakeenv); +#endif if (fakeenv == NULL) { fprintf(stderr, _("date: Memory exhausted\n")); errensure(); @@ -187,8 +193,12 @@ timeout(FILE *fp, char const *format, struct tm const *tmp) ptrdiff_t size = 1024 / 2; for ( ; ; ) { +#ifdef ckd_mul + bool bigger = !ckd_mul(&size, size, 2) && size <= SIZE_MAX; +#else bool bigger = (size <= min(PTRDIFF_MAX, SIZE_MAX) / 2 && (size *= 2, true)); +#endif char *newcp = bigger ? realloc(cp, size) : NULL; if (!newcp) { fprintf(stderr, diff --git a/localtime.c b/localtime.c index 7326567..7faa5d3 100644 --- a/localtime.c +++ b/localtime.c @@ -1565,6 +1565,14 @@ localsub(struct state const *sp, time_t const *timep, int_fast32_t setname, return NULL; /* "cannot happen" */ result = localsub(sp, &newt, setname, tmp); if (result) { +#if defined ckd_add && defined ckd_sub + if (t < sp->ats[0] + ? ckd_sub(&result->tm_year, + result->tm_year, years) + : ckd_add(&result->tm_year, + result->tm_year, years)) + return NULL; +#else register int_fast64_t newy; newy = result->tm_year; @@ -1574,6 +1582,7 @@ localsub(struct state const *sp, time_t const *timep, int_fast32_t setname, if (! (INT_MIN <= newy && newy <= INT_MAX)) return NULL; result->tm_year = newy; +#endif } return result; } @@ -1783,6 +1792,12 @@ timesub(const time_t *timep, int_fast32_t offset, y = newy; } +#ifdef ckd_add + if (ckd_add(&tmp->tm_year, y, -TM_YEAR_BASE)) { + errno = EOVERFLOW; + return NULL; + } +#else if (!TYPE_SIGNED(time_t) && y < TM_YEAR_BASE) { int signed_y = y; tmp->tm_year = signed_y - TM_YEAR_BASE; @@ -1793,6 +1808,7 @@ timesub(const time_t *timep, int_fast32_t offset, errno = EOVERFLOW; return NULL; } +#endif tmp->tm_yday = idays; /* ** The "extra" mods below avoid overflow problems. @@ -1867,6 +1883,9 @@ ctime_r(const time_t *timep, char *buf) static bool increment_overflow(int *ip, int j) { +#ifdef ckd_add + return ckd_add(ip, *ip, j); +#else register int const i = *ip; /* @@ -1879,22 +1898,30 @@ increment_overflow(int *ip, int j) return true; *ip += j; return false; +#endif } static bool increment_overflow32(int_fast32_t *const lp, int const m) { +#ifdef ckd_add + return ckd_add(lp, *lp, m); +#else register int_fast32_t const l = *lp; if ((l >= 0) ? (m > INT_FAST32_MAX - l) : (m < INT_FAST32_MIN - l)) return true; *lp += m; return false; +#endif } static bool increment_overflow_time(time_t *tp, int_fast32_t j) { +#ifdef ckd_add + return ckd_add(tp, *tp, j); +#else /* ** This is like ** 'if (! (TIME_T_MIN <= *tp + j && *tp + j <= TIME_T_MAX)) ...', @@ -1906,6 +1933,7 @@ increment_overflow_time(time_t *tp, int_fast32_t j) return true; *tp += j; return false; +#endif } static bool @@ -2029,11 +2057,16 @@ time2sub(struct tm *const tmp, return WRONG; } } +#ifdef ckd_add + if (ckd_add(&yourtm.tm_year, y, -TM_YEAR_BASE)) + return WRONG; +#else if (increment_overflow32(&y, -TM_YEAR_BASE)) return WRONG; if (! (INT_MIN <= y && y <= INT_MAX)) return WRONG; yourtm.tm_year = y; +#endif if (yourtm.tm_sec >= 0 && yourtm.tm_sec < SECSPERMIN) saved_seconds = 0; else if (yourtm.tm_year < EPOCH_YEAR - TM_YEAR_BASE) { diff --git a/private.h b/private.h index 4315a85..4d40582 100644 --- a/private.h +++ b/private.h @@ -392,6 +392,35 @@ typedef unsigned long uintmax_t; # define SIZE_MAX ((size_t) -1) #endif +/* Support ckd_add, ckd_sub, ckd_mul on C23 or recent-enough GCC-like + hosts, unless compiled with -DHAVE_STDCKDINT_H=0 or with pre-C23 EDG. */ +#if !defined HAVE_STDCKDINT_H && defined __has_include +# if __has_include(<stdckdint.h>) +# define HAVE_STDCKDINT_H true +# endif +#endif +#ifdef HAVE_STDCKDINT_H +# if HAVE_STDCKDINT_H +# include <stdckdint.h> +# endif +#elif defined __EDG__ +/* Do nothing, to work around EDG bug <https://bugs.gnu.org/53256>. */ +#elif defined __has_builtin +# if __has_builtin(__builtin_add_overflow) +# define ckd_add(r, a, b) __builtin_add_overflow(a, b, r) +# endif +# if __has_builtin(__builtin_sub_overflow) +# define ckd_sub(r, a, b) __builtin_sub_overflow(a, b, r) +# endif +# if __has_builtin(__builtin_mul_overflow) +# define ckd_mul(r, a, b) __builtin_mul_overflow(a, b, r) +# endif +#elif 7 <= __GNUC__ +# define ckd_add(r, a, b) __builtin_add_overflow(a, b, r) +# define ckd_sub(r, a, b) __builtin_sub_overflow(a, b, r) +# define ckd_mul(r, a, b) __builtin_mul_overflow(a, b, r) +#endif + #if 3 <= __GNUC__ # define ATTRIBUTE_CONST __attribute__((const)) # define ATTRIBUTE_MALLOC __attribute__((__malloc__)) diff --git a/zdump.c b/zdump.c index 669d8fd..89bcd25 100644 --- a/zdump.c +++ b/zdump.c @@ -137,9 +137,15 @@ size_overflow(void) static ATTRIBUTE_PURE ptrdiff_t sumsize(size_t a, size_t b) { +#ifdef ckd_add + ptrdiff_t sum; + if (!ckd_add(&sum, a, b) && sum <= SIZE_MAX) + return sum; +#else ptrdiff_t sum_max = min(PTRDIFF_MAX, SIZE_MAX); if (a <= sum_max && b <= sum_max - a) return a + b; +#endif size_overflow(); } @@ -254,9 +260,15 @@ tzalloc(char const *val) ptrdiff_t initial_nenvptrs = 1; /* Counting the trailing NULL pointer. */ while (*e++) { +# ifdef ckd_add + if (ckd_add(&initial_nenvptrs, initial_envptrs, 1) + || SIZE_MAX < initial_envptrs) + size_overflow(); +# else if (initial_nenvptrs == min(PTRDIFF_MAX, SIZE_MAX) / sizeof *environ) size_overflow(); initial_nenvptrs++; +# endif } fakeenv0size = sumsize(valsize, valsize); fakeenv0size = max(fakeenv0size, 64); diff --git a/zic.c b/zic.c index a69d4e0..8f8088e 100644 --- a/zic.c +++ b/zic.c @@ -475,18 +475,30 @@ size_overflow(void) static ATTRIBUTE_PURE ptrdiff_t size_sum(size_t a, size_t b) { +#ifdef ckd_add + ptrdiff_t sum; + if (!ckd_add(&sum, a, b) && sum <= SIZE_MAX) + return sum; +#else ptrdiff_t sum_max = min(PTRDIFF_MAX, SIZE_MAX); if (a <= sum_max && b <= sum_max - a) return a + b; +#endif size_overflow(); } static ATTRIBUTE_PURE ptrdiff_t size_product(ptrdiff_t nitems, ptrdiff_t itemsize) { +#ifdef ckd_mul + ptrdiff_t product; + if (!ckd_mul(&product, nitems, itemsize) && product <= SIZE_MAX) + return product; +#else ptrdiff_t nitems_max = min(PTRDIFF_MAX, SIZE_MAX) / itemsize; if (nitems <= nitems_max) return nitems * itemsize; +#endif size_overflow(); } @@ -536,11 +548,18 @@ static ptrdiff_t grow_nitems_alloc(ptrdiff_t *nitems_alloc, ptrdiff_t itemsize) { ptrdiff_t addend = (*nitems_alloc >> 1) + 1; +#if defined ckd_add && defined ckd_mul + ptrdiff_t product; + if (!ckd_add(nitems_alloc, *nitems_alloc, addend) + && !ckd_mul(&product, *nitems_alloc, itemsize) && product <= SIZE_MAX) + return product; +#else ptrdiff_t amax = min(PTRDIFF_MAX, SIZE_MAX); if (*nitems_alloc <= ((amax - 1) / 3 * 2) / itemsize) { *nitems_alloc += addend; return *nitems_alloc * itemsize; } +#endif memory_exhausted(_("integer overflow")); } @@ -3716,16 +3735,28 @@ time_overflow(void) static ATTRIBUTE_PURE zic_t oadd(zic_t t1, zic_t t2) { +#ifdef ckd_add + zic_t sum; + if (!ckd_add(&sum, t1, t2)) + return sum; +#else if (t1 < 0 ? ZIC_MIN - t1 <= t2 : t2 <= ZIC_MAX - t1) return t1 + t2; +#endif time_overflow(); } static ATTRIBUTE_PURE zic_t tadd(zic_t t1, zic_t t2) { +#ifdef ckd_add + zic_t sum; + if (!ckd_add(&sum, t1, t2) && min_time <= sum && sum <= max_time) + return sum; +#else if (t1 < 0 ? min_time - t1 <= t2 : t2 <= max_time - t1) return t1 + t2; +#endif if (t1 == min_time || t1 == max_time) return t1; time_overflow(); -- 2.38.1

1 0

[PROPOSED 0/6] unlikely integer overflow fixes
by Paul Eggert Nov. 20, 2022

Nov. 20, 2022

This patch set fixes some unlikely integer overflow bugs. These patches are relevant only for unusual situations, e.g., objects so large that their sizes exceed PTRDIFF_MAX bytes; or for unusual architectures, e.g., architectures where INT_MAX == UINT_MAX. In most cases I do not know of any practical way to exploit the bug, even if POSIX says the bug is possible. Paul Eggert (6): Don’t assume INT_MAX < UINT_FAST64_MAX Fix size_t overflow check if SIZE_MAX == INT_MAX date: integer overflow fixes Improve integer overflow checking in zdump Fix theoretical integer overflow in zic.c Fix another theoretical zic.c overflow NEWS | 3 ++ date.c | 32 +++++++------------ private.h | 4 +++ zdump.c | 64 +++++++++++++++++++++----------------- zic.c | 92 +++++++++++++++++++++++++++++++++++-------------------- 5 files changed, 113 insertions(+), 82 deletions(-) -- 2.38.1

1 6

[PATCH 1/5] Simplify inputline return value
by Paul Eggert Nov. 20, 2022

Nov. 20, 2022

* zic.c (inputline): Return bool, not ptrdiff_t. All callers changed. --- zic.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/zic.c b/zic.c index 548c1c5..0671889 100644 --- a/zic.c +++ b/zic.c @@ -1575,10 +1575,9 @@ associate(void) /* Read a text line from FP into BUF, which is of size BUFSIZE. Terminate it with a NUL byte instead of a newline. - Return the line's length, not counting the NUL byte. - On EOF, return a negative number. + Return true if successful, false if EOF. On error, report the error and exit. */ -static ptrdiff_t +static bool inputline(FILE *fp, char *buf, ptrdiff_t bufsize) { ptrdiff_t linelen = 0, ch; @@ -1589,7 +1588,7 @@ inputline(FILE *fp, char *buf, ptrdiff_t bufsize) exit(EXIT_FAILURE); } if (linelen == 0) - return -1; + return false; error(_("unterminated line")); exit(EXIT_FAILURE); } @@ -1604,7 +1603,7 @@ inputline(FILE *fp, char *buf, ptrdiff_t bufsize) } } buf[linelen] = '\0'; - return linelen; + return true; } static void @@ -1626,13 +1625,11 @@ infile(int fnum, char const *name) } wantcont = false; for (num = 1; ; ++num) { - ptrdiff_t linelen; char buf[_POSIX2_LINE_MAX]; int nfields; char *fields[MAX_FIELDS]; eat(fnum, num); - linelen = inputline(fp, buf, sizeof buf); - if (linelen < 0) + if (!inputline(fp, buf, sizeof buf)) break; nfields = getfields(buf, fields, sizeof fields / sizeof *fields); -- 2.38.1

1 4