January 2026 - tz - lists.iana.org

Re: tzload: validate tt_utoff to avoid signed overflow
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

In <https://github.com/eggert/tz/pull/37> (2026-01-10) the GitHub user Naveed8951 writes: > The TZif specification guarantees that tt_utoff is never INT32_MIN > so that 32-bit clients can safely negate it. However, tzloadbody() > previously accepted unvalidated values from untrusted TZif input. > A malformed or malicious file could therefore trigger signed integer > overflow during later offset arithmetic (e.g., negation for timezone / > altzone or offset-difference calculations), which is undefined behavior > in C. Naveed8951 submitted a patch that would cause localtime.c to reject TZif files containing UT offsets outside the POSIX range -89999..93599 (-24:59:50 .. 25:59:59), the idea being that small offsets like that would not cause overflow. Unfortunately, I think such a change would still allow undefined behavior in some cases, as overflow could still happen when adding a small offset to a large tm_sec or time_t value. Also, Internet RFC 9636 section 3.2 allows (though it discourages) UT offsets outside the POSIX range. So instead, I fixed localtime.c to handle the outlandish offsets correctly. As a special case, localtime.c (and zic.c) now reject a UT offset exactly equal to -2**31, as RFC 9636 does not allow that and it can easily cause trouble in callers that negate a UT offset stored in a 32-bit integer.

1 0

[PROPOSED] Pacify gcc -Wunused-function with 32-bit time_t
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

* localtime.c (USE_TIMEX_T): Move definition up. (is_threaded, locallock, dolock, dounlock, lock, unlock): Do not define if (defined TM_GMTOFF && USE_TIMEX_T). (rd2wrlock, tm_multi): Move definition down to be closer to use, so that it is nested inside #if and thus defined only when used. --- localtime.c | 117 ++++++++++++++++++++++++++++------------------------ 1 file changed, 62 insertions(+), 55 deletions(-) diff --git a/localtime.c b/localtime.c index a2f92b2a..9b7bbaa9 100644 --- a/localtime.c +++ b/localtime.c @@ -52,6 +52,10 @@ struct stat { char st_ctime, st_dev, st_ino; }; # define THREAD_TM_MULTI 0 #endif +#ifndef USE_TIMEX_T +# define USE_TIMEX_T false +#endif + #if THREAD_SAFE # include <pthread.h> @@ -88,6 +92,10 @@ extern int __isthreaded; # endif # endif # endif +#endif + +#if !defined TM_GMTOFF || !USE_TIMEX_T +# if THREAD_SAFE /* True if the current process might be multi-threaded, false if it is definitely single-threaded. @@ -98,24 +106,25 @@ extern int __isthreaded; static bool is_threaded(void) { -# if THREAD_PREFER_SINGLE && HAVE___ISTHREADED +# if THREAD_PREFER_SINGLE && HAVE___ISTHREADED return !!__isthreaded; -# elif THREAD_PREFER_SINGLE && HAVE_SYS_SINGLE_THREADED_H +# elif THREAD_PREFER_SINGLE && HAVE_SYS_SINGLE_THREADED_H return !__libc_single_threaded; -# else +# else return true; -# endif +# endif } -# if THREAD_RWLOCK +# if THREAD_RWLOCK static pthread_rwlock_t locallock = PTHREAD_RWLOCK_INITIALIZER; static int dolock(void) { return pthread_rwlock_rdlock(&locallock); } static void dounlock(void) { pthread_rwlock_unlock(&locallock); } -# else +# else static pthread_mutex_t locallock = PTHREAD_MUTEX_INITIALIZER; static int dolock(void) { return pthread_mutex_lock(&locallock); } static void dounlock(void) { pthread_mutex_unlock(&locallock); } -# endif +# endif + /* Get a lock. Return 0 on success, a positive errno value on failure, negative if known to be single-threaded so no lock is needed. */ static int @@ -131,25 +140,12 @@ unlock(bool threaded) if (threaded) dounlock(); } -#else +# else static int lock(void) { return -1; } static void unlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) { } +# endif #endif -/* If THREADED, upgrade a read lock to a write lock. - Return 0 on success, a positive errno value otherwise. */ -static int -rd2wrlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) -{ -#if THREAD_RWLOCK - if (threaded) { - dounlock(); - return pthread_rwlock_wrlock(&locallock); - } -#endif - return 0; -} - #if THREAD_SAFE typedef pthread_once_t once_t; # define ONCE_INIT PTHREAD_ONCE_INIT @@ -187,36 +183,6 @@ tm_multi_key_init(void) #endif -/* Return TMP, or a thread-specific struct tm * selected by WHICH. */ -static struct tm * -tm_multi(struct tm *tmp, ATTRIBUTE_MAYBE_UNUSED enum tm_multi which) -{ -#if THREAD_SAFE && THREAD_TM_MULTI - /* It is OK to check is_threaded() separately here; even if it - returns a different value in other places in the caller, - this function's behavior is still valid. */ - if (is_threaded()) { - /* Try to get a thread-specific struct tm *. - Fall back on TMP if this fails. */ - static pthread_once_t tm_multi_once = PTHREAD_ONCE_INIT; - pthread_once(&tm_multi_once, tm_multi_key_init); - if (!tm_multi_key_err) { - struct tm *p = pthread_getspecific(tm_multi_key); - if (!p) { - p = malloc(N_TM_MULTI * sizeof *p); - if (p && pthread_setspecific(tm_multi_key, p) != 0) { - free(p); - p = NULL; - } - } - if (p) - return &p[which]; - } - } -#endif - return tmp; -} - /* Unless intptr_t is missing, pacify gcc -Wcast-qual on char const * exprs. Use this carefully, as the casts disable type checking. This is a macro so that it can be used in static initializers. */ @@ -293,9 +259,6 @@ typedef time_t monotime_t; to a static function that returns the redefined time_t. It also tells us to define only data and code needed to support the offtime or mktime variant. */ -#ifndef USE_TIMEX_T -# define USE_TIMEX_T false -#endif #if USE_TIMEX_T # undef TIME_T_MIN # undef TIME_T_MAX @@ -1843,6 +1806,20 @@ zoneinit(struct state *sp, char const *name, char tzloadflags) } } +/* If THREADED, upgrade a read lock to a write lock. + Return 0 on success, a positive errno value otherwise. */ +static int +rd2wrlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) +{ +# if THREAD_RWLOCK + if (threaded) { + dounlock(); + return pthread_rwlock_wrlock(&locallock); + } +# endif + return 0; +} + /* Like tzset(), but in a critical section. If THREADED && THREAD_RWLOCK the caller has a read lock, and this function might upgrade it to a write lock. @@ -2134,6 +2111,36 @@ localsub(struct state const *sp, time_t const *timep, int_fast32_t setname, #if !USE_TIMEX_T +/* Return TMP, or a thread-specific struct tm * selected by WHICH. */ +static struct tm * +tm_multi(struct tm *tmp, ATTRIBUTE_MAYBE_UNUSED enum tm_multi which) +{ +# if THREAD_SAFE && THREAD_TM_MULTI + /* It is OK to check is_threaded() separately here; even if it + returns a different value in other places in the caller, + this function's behavior is still valid. */ + if (is_threaded()) { + /* Try to get a thread-specific struct tm *. + Fall back on TMP if this fails. */ + static pthread_once_t tm_multi_once = PTHREAD_ONCE_INIT; + pthread_once(&tm_multi_once, tm_multi_key_init); + if (!tm_multi_key_err) { + struct tm *p = pthread_getspecific(tm_multi_key); + if (!p) { + p = malloc(N_TM_MULTI * sizeof *p); + if (p && pthread_setspecific(tm_multi_key, p) != 0) { + free(p); + p = NULL; + } + } + if (p) + return &p[which]; + } + } +# endif + return tmp; +} + # if NETBSD_INSPIRED struct tm * localtime_rz(struct state *restrict sp, time_t const *restrict timep, -- 2.52.0

1 0

[PROPOSED 0/6] Fix integer overflows and drop posixrules
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

GitHub user Naveed8951 reported a potential (but unlikely) security flaw due to undefined behavior in localtime.c after integer overflow. The patches in this series should fix the reported problems. Some of the problem occurred in a part of the localtime.c code that was implementing a feature declared obsolete in TZDB release 2019b. This feature let the sysadmin specify default DST rules for DST-but-ruleless old-style POSIX settings like TZ="AST4ADT". Rather than try to fix the feature this patch series removes it; the feature is hardly ever used and would stop working in 2038 anyway. As a result, tzcode by default uses current US DST for these settings, with no opportunity for sysadmin override (though the default can be overriden when tzcode is compiled). This behavior is already common elsewhere. Paul Eggert (6): Add comment re UT offsets equal to -2**31 Document zic -p better zic now warns about -p Remove POSIXRULES installation option Remove TZDEFRULES ("posixrules") from localtime.c Fix remaining Naveed8951-reported overflows Makefile | 28 +--- NEWS | 19 +++ localtime.c | 388 ++++++++++++++++++++++++---------------------------- newctime.3 | 4 +- newtzset.3 | 29 +--- tzfile.5 | 7 +- tzfile.h | 12 +- zic.8 | 17 ++- zic.c | 8 ++ 9 files changed, 228 insertions(+), 284 deletions(-) -- 2.52.0

1 6

Unable to find Doha in the database
by Paul Menzel Jan. 15, 2026

Jan. 15, 2026

Dear Time Zone Database folks, Visiting Doha, I wanted to change to its time zone, and knowing `Europe/Berlin`, I looked for *Doha*, but didn’t find it in GNOME [1]. Looking through the Time Zone Database archive, there is in `asia` [3]: # Bahrain # Qatar # Zone NAME STDOFF RULES FORMAT [UNTIL] Zone Asia/Qatar 3:26:08 - LMT 1920 # Al Dawhah / Doha 4:00 - %z 1972 Jun 3:00 - %z The comment is not in my file on Debian though in `/usr/share/zoneinfo/tzdata.zi` from *tzdata* 2025c-3. Z Asia/Qatar 3:26:8 - LMT 1920 4 - %z 1972 Jun 3 - %z Of course, I do not know, if the comment would change anything. Would it be possible to also add Qatar’s capital to the database. Or is there another way to make it easier for people to find the right time zone entry? Kind regards, Paul [1]: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/3656 [2]: https://github.com/eggert/tz/blob/d5f71488fd1ec4a2f7166ceeac2024a677daaaef/…

3 2

[PROPOSED 0/5] Fix some unlikely undefined behaviors
by Paul Eggert Jan. 12, 2026

Jan. 12, 2026

This patchest fixes some bugs in localtime.c when TZif files specify a UT offset equal to -2**31. Such an offset overflows when negated on a 32-bit platform, and this leads to undefined behavior – typically wraparound arithmetic, but the C standard says anything can happen. The patchset also changes zic.c to reject attempts to create such an offset, adjusts some nearby code to be a bit cleaner and more portable. Paul Eggert (5): Omit unnecessary L suffixes zic no longer generates utoff == -2**31 Make sure 2**31 - 1 is signed Port TWOS_COMPLEMENT to signed-magnitude hosts Disallow UT offsets equal to -2**31 NEWS | 4 ++++ localtime.c | 48 ++++++++++++++++++++++++++++++++---------------- private.h | 7 +++++-- strftime.c | 5 +++-- zic.c | 7 ++++--- 5 files changed, 48 insertions(+), 23 deletions(-) -- 2.51.0

1 5

[PROPOSED] Improve .gitignore patterns
by Paul Eggert Jan. 10, 2026

Jan. 10, 2026

* .gitignore: Ignore all subdirectories. Also ignore *.bak, *.core, *.out, *.t, core, and core.*. Also ignore .*, except for .gitignore itself. --- .gitignore | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index e7bb0416..5a140b46 100644 --- a/.gitignore +++ b/.gitignore @@ -1,26 +1,38 @@ # Files intentionally not tracked by Git. # This file is in the public domain. +# +# Ignore all subdirectories. +*/ +# +# Ignore non-directories that are the output of builds, +# or are backups or nonces unlikely to be added to the repository. *.a *.asc +*.bak *.ck -*.ckd/ +*.core *.diff -*.dir/ *.i *.o *.orig +*.out *.patch *.pdf *.ps *.rej *.s +*.t *.tar *.tar.* *.txt *.tzs *.zi *~ +.* +!.gitignore ChangeLog +core +core.* date leapseconds tzdir.h -- 2.51.0

1 0

Whither /usr/share/zoneinfo/right?
by Paul Gilmartin Jan. 8, 2026

Jan. 8, 2026

ISTR on Linux long ago, a subdirectory, /usr/share/zoneinfo/right, which used arguments not POSIX time but TAI. Was that a local hack, or was it removed, possibly because of uncertainty of future leap seconds? -- Thanks, gil

4 5

Fwd: Bulletin C number 71
by Tim Parenti Jan. 7, 2026

Jan. 7, 2026

No leap second 2026-06-30, per below. See attached patch. -- Tim Parenti ---------- Forwarded message --------- From: IERS EOP Product Center <iers.eoppc(a)obspm.fr> Date: Tue, 6 Jan 2026 at 06:50 Subject: Bulletin C number 71 To: <bulc.iers(a)obspm.fr> INTERNATIONAL EARTH ROTATION AND REFERENCE SYSTEMS SERVICE (IERS) SERVICE INTERNATIONAL DE LA ROTATION TERRESTRE ET DES SYSTEMES DE REFERENCE SERVICE DE LA ROTATION TERRESTRE DE L'IERS OBSERVATOIRE DE PARIS 61, Av. de l'Observatoire 75014 PARIS (France) Tel. : +33 1 40 51 23 35 e-mail : services.iers(a)obspm.fr http://hpiers.obspm.fr/eop-pc Paris, 06 January 2026 Bulletin C 71 To authorities responsible for the measurement and distribution of time INFORMATION ON UTC - TAI NO leap second will be introduced at the end of June 2026. The difference between Coordinated Universal Time UTC and the International Atomic Time TAI is : from 2017 January 1, 0h UTC, until further notice : UTC-TAI = -37 s Leap seconds can be introduced in UTC at the end of the months of December or June, depending on the evolution of UT1-TAI. Bulletin C is mailed every six months, either to announce a time step in UTC, or to confirm that there will be no time step at the next possible date. Christian BIZOUARD Director Earth Orientation Center of IERS Observatoire de Paris, France

2 1

static_assert macro
by Christos Zoulas Jan. 7, 2026

Jan. 7, 2026

Hello, The new tzcode uses static_assert() with no message which is a c2x extension. clang does not like that by default (without specifying -std=gnu2x). /home/source/ab/HEAD-llvm/src/lib/libc/time/private.h:1017:52: error: '_Static_assert' with no message is a C2x extension [-Werror,-Wc2x-extensions] || TIME_T_MAX >> (TYPE_BIT(time_t) - 2) == 1); ^ , "" Best, christos

3 4