- tz - lists.iana.org

[PROPOSED] New -DTZ_RUNTIME_LEAPS=0 build-time option
by Paul Eggert Jan. 22, 2026

Jan. 22, 2026

This implements my suggestion in: https://lists.iana.org/hyperkitty/list/tz@iana.org/thread/Y4WLBYNBTFFG2XEQH… to add a compile-time option to disable localtime.c's support for leap seconds, and thereby shrink the attack surface on tzcode. * Makefile, NEWS, date.1, etcetera, zic.8: Mention this. * localtime.c (struct state): Define leapcnt and lsis members only if TZ_RUNTIME_LEAPS. All uses removed and replaced with the following: (leapcount, set_leapcount, lsinfo, set_lsinfo): New static getter and setter functions for leap second data. (tzloadbody) [!TZ_RUNTIME_LEAPS]: Reject TZif files with leap seconds. (gmtload) [!TZ_RUNTIME_LEAPS]: Do not load from TZLOAD_TZSTRING since we are not doing leap seconds. * private.h (TZ_RUNTIME_LEAPS, ATTRIBUTE_POSIX2TIME): New macros. (posix2time_z, time2posix_z): Declare with ATTRIBUTE_POSIX2TIME not ATTRIBUTE_PURE, because these functions are const (not merely pure) when leap seconds are disabled. --- Makefile | 4 ++ NEWS | 6 +++ date.1 | 2 +- etcetera | 3 +- localtime.c | 125 ++++++++++++++++++++++++++++++++++------------------ private.h | 13 +++++- zic.8 | 3 +- 7 files changed, 108 insertions(+), 48 deletions(-) diff --git a/Makefile b/Makefile index 021186fc..1e0a5903 100644 --- a/Makefile +++ b/Makefile @@ -328,6 +328,10 @@ LDLIBS= # -DTZ_DOMAIN=\"foo\" to use "foo" for gettext domain name; default is "tz" # -DTZ_DOMAINDIR=\"/path\" to use "/path" for gettext directory; # the default is system-supplied, typically "/usr/lib/locale" +# -DTZ_RUNTIME_LEAPS=0 to disable runtime support for leap seconds. +# This conforms to POSIX, shrinks tzcode's attack surface, +# and is more efficient. However, it fails to support Internet +# RFC 9636's leap seconds. # -DTZDEFRULESTRING=\",date/time,date/time\" to default to the specified # DST transitions for proleptic format TZ strings lacking them. # If not specified, it defaults to US rules for future DST transitions. diff --git a/NEWS b/NEWS index 995507f0..95b1851c 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ Unreleased, experimental changes Briefly: The "right" TZif files are no longer installed by default. + -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds. Several integer overflow bugs have been fixed. Changes to build procedure @@ -23,6 +24,11 @@ Unreleased, experimental changes Changes to code + Compiling with the new option -DTZ_RUNTIME_LEAPS=0 disables + runtime support for leap seconds. Although this conforms to + POSIX, shrinks tzcode's attack surface, and is more efficient, + it fails to support Internet RFC 9636's leap seconds. + localtime.c no longer accesses the posixrules file generated by zic -p. Hence for obsolete and nonconforming settings like TZ="AST4ADT" it now typically falls back on US DST rules, rather diff --git a/date.1 b/date.1 index 5f334358..8f2c212b 100644 --- a/date.1 +++ b/date.1 @@ -77,6 +77,6 @@ hexadecimal (leading 0x), preceded by an optional sign. .br /usr/share/zoneinfo timezone directory .br -/usr/share/zoneinfo/Etc/UTC for UTC leap seconds +/usr/share/zoneinfo/Etc/UTC for UTC leap seconds, if supported .SH SEE ALSO .BR strftime (3). diff --git a/etcetera b/etcetera index 948531c8..d78f0413 100644 --- a/etcetera +++ b/etcetera @@ -20,7 +20,8 @@ # which load the "UTC" file to handle seconds properly. Zone Etc/UTC 0 - UTC -# Functions like gmtime load the "GMT" file to handle leap seconds properly. +# If leap second support is enabled, functions like gmtime +# load the "GMT" file to handle leap seconds properly. # Vanguard section, which works with most .zi parsers. #Zone GMT 0 - GMT # Rearguard section, for TZUpdater 2.3.2 and earlier. diff --git a/localtime.c b/localtime.c index 40a4d7ee..ed7a32f2 100644 --- a/localtime.c +++ b/localtime.c @@ -498,7 +498,9 @@ enum { CHARS_EXTRA = max(sizeof UNSPEC, 2) - 1 }; are put on the stack and stacks are relatively small on some platforms. See tzfile.h for more about the sizes. */ struct state { +#if TZ_RUNTIME_LEAPS int leapcnt; +#endif int timecnt; int typecnt; int charcnt; @@ -509,9 +511,48 @@ struct state { struct ttinfo ttis[TZ_MAX_TYPES]; char chars[max(max(TZ_MAX_CHARS + CHARS_EXTRA, sizeof "UTC"), 2 * (TZNAME_MAXIMUM + 1))]; +#if TZ_RUNTIME_LEAPS struct lsinfo lsis[TZ_MAX_LEAPS]; +#endif }; +static int +leapcount(ATTRIBUTE_MAYBE_UNUSED struct state const *sp) +{ +#if TZ_RUNTIME_LEAPS + return sp->leapcnt; +#else + return 0; +#endif +} +static void +set_leapcount(ATTRIBUTE_MAYBE_UNUSED struct state *sp, + ATTRIBUTE_MAYBE_UNUSED int leapcnt) +{ +#if TZ_RUNTIME_LEAPS + sp->leapcnt = leapcnt; +#endif +} +static struct lsinfo +lsinfo(ATTRIBUTE_MAYBE_UNUSED struct state const *sp, + ATTRIBUTE_MAYBE_UNUSED int i) +{ +#if TZ_RUNTIME_LEAPS + return sp->lsis[i]; +#else + unreachable(); +#endif +} +static void +set_lsinfo(ATTRIBUTE_MAYBE_UNUSED struct state *sp, + ATTRIBUTE_MAYBE_UNUSED int i, + ATTRIBUTE_MAYBE_UNUSED struct lsinfo lsinfo) +{ +#if TZ_RUNTIME_LEAPS + sp->lsis[i] = lsinfo; +#endif +} + enum r_type { JULIAN_DAY, /* Jn = Julian day */ DAY_OF_YEAR, /* n = day of year */ @@ -1005,8 +1046,6 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, char version = up->tzhead.tzh_version[0]; bool skip_datablock = stored == 4 && version; int_fast32_t datablock_size; - int_fast64_t prevtr = -1; - int_fast32_2s prevcorr; int_fast32_2s ttisstdcnt = detzcode(up->tzhead.tzh_ttisstdcnt), ttisutcnt = detzcode(up->tzhead.tzh_ttisutcnt), @@ -1018,7 +1057,8 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Although tzfile(5) currently requires typecnt to be nonzero, support future formats that may allow zero typecnt in files that have a TZ string and no transitions. */ - if (! (0 <= leapcnt && leapcnt <= TZ_MAX_LEAPS + if (! (0 <= leapcnt + && leapcnt <= (TZ_RUNTIME_LEAPS ? TZ_MAX_LEAPS : 0) && 0 <= typecnt && typecnt <= TZ_MAX_TYPES && 0 <= timecnt && timecnt <= TZ_MAX_TIMES && 0 <= charcnt && charcnt <= TZ_MAX_CHARS @@ -1037,12 +1077,13 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, return EINVAL; if (skip_datablock) p += datablock_size; + else if (! ((ttisstdcnt == typecnt || ttisstdcnt == 0) + && (ttisutcnt == typecnt || ttisutcnt == 0))) + return EINVAL; else { - if (! ((ttisstdcnt == typecnt || ttisstdcnt == 0) - && (ttisutcnt == typecnt || ttisutcnt == 0))) - return EINVAL; - - sp->leapcnt = leapcnt; + int_fast64_t prevtr = -1; + int_fast32_2s prevcorr; + set_leapcount(sp, leapcnt); sp->timecnt = timecnt; sp->typecnt = typecnt; sp->charcnt = charcnt; @@ -1110,7 +1151,7 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Read leap seconds, discarding those out of time_t range. */ leapcnt = 0; - for (i = 0; i < sp->leapcnt; ++i) { + for (i = 0; i < leapcount(sp); i++) { int_fast64_t tr = stored == 4 ? detzcode(p) : detzcode64(p); int_fast32_2s corr = detzcode(p + stored); p += stored + 4; @@ -1135,12 +1176,14 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, prevcorr = corr; if (tr <= TIME_T_MAX) { - sp->lsis[leapcnt].ls_trans = tr; - sp->lsis[leapcnt].ls_corr = corr; + struct lsinfo ls; + ls.ls_trans = tr; + ls.ls_corr = corr; + set_lsinfo(sp, leapcnt, ls); leapcnt++; } } - sp->leapcnt = leapcnt; + set_leapcount(sp, leapcnt); for (i = 0; i < sp->typecnt; ++i) { register struct ttinfo * ttisp; @@ -1605,13 +1648,15 @@ tzparse(const char *name, struct state *sp, struct state const *basep) if (basep) { if (0 < basep->timecnt) atlo = basep->ats[basep->timecnt - 1]; - sp->leapcnt = basep->leapcnt; - if (0 < sp->leapcnt) { - memcpy(sp->lsis, basep->lsis, sp->leapcnt * sizeof *sp->lsis); - leaplo = sp->lsis[sp->leapcnt - 1].ls_trans; + set_leapcount(sp, leapcount(basep)); + if (0 < leapcount(sp)) { + int i; + for (i = 0; i < leapcount(sp); i++) + set_lsinfo(sp, i, lsinfo(basep, i)); + leaplo = lsinfo(sp, leapcount(sp) - 1).ls_trans; } } else - sp->leapcnt = 0; /* So, we're off a little. */ + set_leapcount(sp, 0); /* So, we're off a little. */ sp->goback = sp->goahead = false; if (*name != '\0') { struct rule start, end; @@ -1755,7 +1800,7 @@ tzparse(const char *name, struct state *sp, struct state const *basep) static void gmtload(struct state *const sp) { - if (tzload(etc_utc, sp, TZLOAD_TZSTRING) != 0) + if (!TZ_RUNTIME_LEAPS || tzload(etc_utc, sp, TZLOAD_TZSTRING) != 0) tzparse("UTC0", sp, NULL); } @@ -1787,7 +1832,7 @@ zoneinit(struct state *sp, char const *name, char tzloadflags) /* ** User wants it fast rather than right. */ - sp->leapcnt = 0; /* so, we're off a little */ + set_leapcount(sp, 0); /* so, we're off a little */ sp->timecnt = 0; sp->typecnt = 0; sp->charcnt = 0; @@ -2274,7 +2319,6 @@ static struct tm * timesub(const time_t *timep, int_fast32_t offset, const struct state *sp, struct tm *tmp) { - register const struct lsinfo * lp; register time_t tdays; register const int * ip; int_fast32_2s corr; @@ -2288,13 +2332,13 @@ timesub(const time_t *timep, int_fast32_t offset, time_t secs_since_posleap = SECSPERMIN; corr = 0; - i = (sp == NULL) ? 0 : sp->leapcnt; + i = sp ? leapcount(sp) : 0; while (--i >= 0) { - lp = &sp->lsis[i]; - if (*timep >= lp->ls_trans) { - corr = lp->ls_corr; - if ((i == 0 ? 0 : lp[-1].ls_corr) < corr) - secs_since_posleap = *timep - lp->ls_trans; + struct lsinfo ls = lsinfo(sp, i); + if (ls.ls_trans <= *timep) { + corr = ls.ls_corr; + if ((i == 0 ? 0 : lsinfo(sp, i - 1).ls_corr) < corr) + secs_since_posleap = *timep - ls.ls_trans; break; } } @@ -2948,14 +2992,13 @@ timegm(struct tm *tmp) static int_fast32_2s leapcorr(struct state const *sp, time_t t) { - register struct lsinfo const * lp; register int i; - i = sp->leapcnt; + i = leapcount(sp); while (--i >= 0) { - lp = &sp->lsis[i]; - if (t >= lp->ls_trans) - return lp->ls_corr; + struct lsinfo ls = lsinfo(sp, i); + if (ls.ls_trans <= t) + return ls.ls_corr; } return 0; } @@ -3031,13 +3074,12 @@ NETBSD_INSPIRED_EXTERN time_t posix2time_z(struct state *sp, time_t t) { int i; - for (i = sp->leapcnt; 0 <= --i; ) { - struct lsinfo *lp = &sp->lsis[i]; - int_fast32_2s corr = lp->ls_corr; + for (i = leapcount(sp); 0 <= --i; ) { + struct lsinfo ls = lsinfo(sp, i); time_t t_corr = t; - if (increment_overflow_time(&t_corr, corr)) { - if (0 <= corr) { + if (increment_overflow_time(&t_corr, ls.ls_corr)) { + if (0 <= ls.ls_corr) { /* Overflow near maximum time_t value with positive correction. This can happen with ordinary TZif files with leap seconds. */ errno = EOVERFLOW; @@ -3046,13 +3088,10 @@ posix2time_z(struct state *sp, time_t t) /* A negative correction overflowed, so keep going. This can happen with unrealistic-but-valid TZif files. */ } - } else { - time_t trans = lp->ls_trans; - if (trans <= t_corr) - return (t_corr - - (trans == t_corr - && (i == 0 ? 0 : sp->lsis[i - 1].ls_corr) < corr)); - } + } else if (ls.ls_trans <= t_corr) + return (t_corr + - (ls.ls_trans == t_corr + && (i == 0 ? 0 : lsinfo(sp, i - 1).ls_corr) < ls.ls_corr)); } return t; } diff --git a/private.h b/private.h index e8cf9c22..6a58b073 100644 --- a/private.h +++ b/private.h @@ -193,6 +193,10 @@ # define ctime_r _incompatible_ctime_r #endif /* HAVE_INCOMPATIBLE_CTIME_R */ +#ifndef TZ_RUNTIME_LEAPS +# define TZ_RUNTIME_LEAPS 1 +#endif + /* ** Nested includes */ @@ -922,11 +926,16 @@ time_t mktime_z(timezone_t restrict, struct tm *restrict); timezone_t tzalloc(char const *); void tzfree(timezone_t); # if STD_INSPIRED +# if TZ_RUNTIME_LEAPS +# define ATTRIBUTE_POSIX2TIME ATTRIBUTE_PURE +# else +# define ATTRIBUTE_POSIX2TIME ATTRIBUTE_CONST +# endif # if TZ_TIME_T || !defined posix2time_z -ATTRIBUTE_PURE time_t posix2time_z(timezone_t, time_t); +ATTRIBUTE_POSIX2TIME time_t posix2time_z(timezone_t, time_t); # endif # if TZ_TIME_T || !defined time2posix_z -ATTRIBUTE_PURE time_t time2posix_z(timezone_t, time_t); +ATTRIBUTE_POSIX2TIME time_t time2posix_z(timezone_t, time_t); # endif # endif #endif diff --git a/zic.8 b/zic.8 index 73b19ca9..05eea105 100644 --- a/zic.8 +++ b/zic.8 @@ -107,7 +107,8 @@ any already-existing link is removed. .BI "\-L " leapsecondfilename Read leap second information from the file with the given name. If this option is not used, -no leap second information appears in output files. +no leap second information appears in output files; +this is required by some TZif readers. .TP .BI "\-p " timezone Act as if the input contained a link line of the form -- 2.52.0

1 0

Greenland daylight saving during World War II
by Paul Eggert Jan. 22, 2026

Jan. 22, 2026

Greenland's been in the political news lately, and while reading about its history I found an unsourced statement in Wikipedia[1] that Greenland observed daylight saving time during World War II. I found a few published sources confirming this, but none with enough details for me to figure out what changes should go into tzdata. For now I installed the attached proposed patch which merely adds commentary. If someone could find the details we could fix the data accordingly. [1]: https://en.wikipedia.org/wiki/Greenland_in_World_War_II

1 0

[PROPOSED] TZ_MAX_TIMES must be at least 310 now
by Paul Eggert Jan. 22, 2026

Jan. 22, 2026

* tzfile.h: Asia/Hebron is the new champion. --- tzfile.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tzfile.h b/tzfile.h index d1f0fbe6..71b60f37 100644 --- a/tzfile.h +++ b/tzfile.h @@ -89,7 +89,7 @@ struct tzhead { */ #ifndef TZ_MAX_TIMES -/* This must be at least 242 for Europe/London with 'zic -b fat'. */ +/* This must be at least 310 for Asia/Hebron with 'zic -b fat'. */ # define TZ_MAX_TIMES 2000 #endif /* !defined TZ_MAX_TIMES */ -- 2.52.0

1 0

[PROPOSED] Fix pre-C23 typos in recent overflow fixes
by Paul Eggert Jan. 21, 2026

Jan. 21, 2026

* localtime.c (time2sub) [!defined ckd_sub]: Fix typos in Friday’s “Fix remaining Naveed8951-reported overflows” changes. This is needed for GCC 13 and earlier, and for other pre-C23 compilers that lack <stdckdint.h>. --- localtime.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/localtime.c b/localtime.c index 698f61bf..40a4d7ee 100644 --- a/localtime.c +++ b/localtime.c @@ -2697,8 +2697,8 @@ time2sub(struct tm *const tmp, v = ckd_sub(&offdiff, mytm.TM_GMTOFF, yourtm.TM_GMTOFF); # else /* A ckd_sub approximation that is good enough here. */ - v = !(-TWO_31_MINUS_1 <= yourm.TM_GMTOFF - && your.TM_GMTOFF <= TWO_31_MINUS_1); + v = !(-TWO_31_MINUS_1 <= yourtm.TM_GMTOFF + && yourtm.TM_GMTOFF <= TWO_31_MINUS_1); if (!v) offdiff = utoff_diff(mytm.TM_GMTOFF, yourtm.TM_GMTOFF); # endif -- 2.52.0

1 0

[PROPOSED] Support slightly-larger TZif files
by Paul Eggert Jan. 21, 2026

Jan. 21, 2026

* NEWS: Mention this. * localtime.c (tzloadbody): Fix off-by-one errors in tests that mistakenly caused the code to reject TZif files that actually fit. Problem introduced in release 2014g, by my commit 13a277175c603cfb62ae5bdcf26e23faf5619ef1 dated 2014-08-19. --- NEWS | 3 +++ localtime.c | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/NEWS b/NEWS index 71bd91e4..995507f0 100644 --- a/NEWS +++ b/NEWS @@ -43,6 +43,9 @@ Unreleased, experimental changes outlandish but conforming UT offsets or leap second corrections, has also been fixed. (Also reported by Naveed8951.) + localtime.c no longer rejects TZif files that exactly fit in its + internal structures, fixing off-by-one typos introduced in 2014g. + zic no longer generates a no-op transition when simultaneous Rule and Zone changes cancel each other out. This occurs in tzdata only in Asia/Tbilisi on 1997-03-30. diff --git a/localtime.c b/localtime.c index aa9b48ca..698f61bf 100644 --- a/localtime.c +++ b/localtime.c @@ -1018,12 +1018,12 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Although tzfile(5) currently requires typecnt to be nonzero, support future formats that may allow zero typecnt in files that have a TZ string and no transitions. */ - if (! (0 <= leapcnt && leapcnt < TZ_MAX_LEAPS - && 0 <= typecnt && typecnt < TZ_MAX_TYPES - && 0 <= timecnt && timecnt < TZ_MAX_TIMES - && 0 <= charcnt && charcnt < TZ_MAX_CHARS - && 0 <= ttisstdcnt && ttisstdcnt < TZ_MAX_TYPES - && 0 <= ttisutcnt && ttisutcnt < TZ_MAX_TYPES)) + if (! (0 <= leapcnt && leapcnt <= TZ_MAX_LEAPS + && 0 <= typecnt && typecnt <= TZ_MAX_TYPES + && 0 <= timecnt && timecnt <= TZ_MAX_TIMES + && 0 <= charcnt && charcnt <= TZ_MAX_CHARS + && 0 <= ttisstdcnt && ttisstdcnt <= TZ_MAX_TYPES + && 0 <= ttisutcnt && ttisutcnt <= TZ_MAX_TYPES)) return EINVAL; datablock_size = (timecnt * stored /* ats */ -- 2.51.0

1 0

[PROPOSED 0/3] Leap second overflow bugs
by Paul Eggert Jan. 20, 2026

Jan. 20, 2026

This patch series fixes some bugs involving integer overflow in leap second calculations at runtime. The main problem is with the optional time2posix and posix2time functions; without the patches the functions can crash or loop indefinitely or return completely-wrong answers. With these patches the functions have new, documented behavior: they return (time_t) -1 and set errno to EOVERFLOW when the result is not representable, instead of behaving badly in tricky situations. Given the problems I've been seeing with the leap second runtime code, and given the worry that similar problems remain, and given that the leap second runtime code is rarely used in practice, I'm thinking it may be a good idea to add a compile-time option to disable localtime.c's support for leap seconds. Using the option would shrink the attack surface on tzcode. Paul Eggert (3): Fix theoretical -2**31 leapcorr bug Improve time2posix man page Fix overflow bugs in time2posix and posix2time NEWS | 13 ++++- localtime.c | 90 +++++++++++++++++++++------------- time2posix.3 | 134 ++++++++++++++++++++++++++++++++++----------------- 3 files changed, 156 insertions(+), 81 deletions(-) -- 2.51.0

1 3

[PROPOSED] Check with -Wzero-as-null-pointer-constant
by Paul Eggert Jan. 18, 2026

Jan. 18, 2026

* Makefile (GCC_DEBUG_FLAGS): Omit -Wstringop-truncation, as it’s the default. Add -Wzero-as-null-pointer-constant. --- Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 570518c4..021186fc 100644 --- a/Makefile +++ b/Makefile @@ -380,12 +380,13 @@ GCC_DEBUG_FLAGS = -DGCC_LINT -g3 -O3 \ -Wold-style-definition -Woverlength-strings -Wpointer-arith \ -Wshadow -Wshift-overflow=2 -Wstrict-overflow \ -Wstrict-prototypes -Wstringop-overflow=4 \ - -Wstringop-truncation -Wsuggest-attribute=cold \ + -Wsuggest-attribute=cold \ -Wsuggest-attribute=const -Wsuggest-attribute=format \ -Wsuggest-attribute=malloc \ -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure \ -Wtrampolines -Wundef -Wunused-macros -Wuse-after-free=3 \ -Wvariadic-macros -Wvla -Wwrite-strings \ + -Wzero-as-null-pointer-constant \ -Wno-format-nonliteral -Wno-sign-compare -Wno-type-limits # # If your system has a "GMT offset" field in its "struct tm"s -- 2.51.0

1 0

[PROPOSED] Simplify int_fast32_t definition on C89 platforms
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

* private.h (int_fast32_t, INT_FAST32_MAX, INT_FAST32_MIN): When PORT_TO_C89 is defined, simplify these fallback definitions by using long rather than attempting to use int on platforms where int suffices. The attempt’s test was too strict: its ‘INT_MAX >> 31 == 0’ should have been ‘INT_MAX >> 30 == 0’. This led to a possible performance bug on C89 platforms where int is 32 bits, as int_fast32_t was defined to be long when int would suffice. C89 platforms are now museum pieces and this code is currently scheduled to be removed in 2029 or so anyway, so it is not worth trying to measure and debug any performance issues. Simplify the definitions instead. That mirrors what is already being done for uint_fast32_t. --- private.h | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/private.h b/private.h index 42a1c892..e8cf9c22 100644 --- a/private.h +++ b/private.h @@ -410,15 +410,9 @@ typedef long long int_fast64_t; # endif # ifndef INT_FAST32_MAX -# if INT_MAX >> 31 == 0 typedef long int_fast32_t; -# define INT_FAST32_MAX LONG_MAX -# define INT_FAST32_MIN LONG_MIN -# else -typedef int int_fast32_t; -# define INT_FAST32_MAX INT_MAX -# define INT_FAST32_MIN INT_MIN -# endif +# define INT_FAST32_MAX LONG_MAX +# define INT_FAST32_MIN LONG_MIN # endif # ifndef INT_LEAST32_MAX -- 2.51.0

1 0

Re: tzload: validate tt_utoff to avoid signed overflow
by Paul Eggert Jan. 16, 2026

Jan. 16, 2026

In <https://github.com/eggert/tz/pull/37> (2026-01-10) the GitHub user Naveed8951 writes: > The TZif specification guarantees that tt_utoff is never INT32_MIN > so that 32-bit clients can safely negate it. However, tzloadbody() > previously accepted unvalidated values from untrusted TZif input. > A malformed or malicious file could therefore trigger signed integer > overflow during later offset arithmetic (e.g., negation for timezone / > altzone or offset-difference calculations), which is undefined behavior > in C. Naveed8951 submitted a patch that would cause localtime.c to reject TZif files containing UT offsets outside the POSIX range -89999..93599 (-24:59:50 .. 25:59:59), the idea being that small offsets like that would not cause overflow. Unfortunately, I think such a change would still allow undefined behavior in some cases, as overflow could still happen when adding a small offset to a large tm_sec or time_t value. Also, Internet RFC 9636 section 3.2 allows (though it discourages) UT offsets outside the POSIX range. So instead, I fixed localtime.c to handle the outlandish offsets correctly. As a special case, localtime.c (and zic.c) now reject a UT offset exactly equal to -2**31, as RFC 9636 does not allow that and it can easily cause trouble in callers that negate a UT offset stored in a 32-bit integer.

1 0

[PROPOSED] Pacify gcc -Wunused-function with 32-bit time_t
by Paul Eggert Jan. 16, 2026

Jan. 16, 2026

* localtime.c (USE_TIMEX_T): Move definition up. (is_threaded, locallock, dolock, dounlock, lock, unlock): Do not define if (defined TM_GMTOFF && USE_TIMEX_T). (rd2wrlock, tm_multi): Move definition down to be closer to use, so that it is nested inside #if and thus defined only when used. --- localtime.c | 117 ++++++++++++++++++++++++++++------------------------ 1 file changed, 62 insertions(+), 55 deletions(-) diff --git a/localtime.c b/localtime.c index a2f92b2a..9b7bbaa9 100644 --- a/localtime.c +++ b/localtime.c @@ -52,6 +52,10 @@ struct stat { char st_ctime, st_dev, st_ino; }; # define THREAD_TM_MULTI 0 #endif +#ifndef USE_TIMEX_T +# define USE_TIMEX_T false +#endif + #if THREAD_SAFE # include <pthread.h> @@ -88,6 +92,10 @@ extern int __isthreaded; # endif # endif # endif +#endif + +#if !defined TM_GMTOFF || !USE_TIMEX_T +# if THREAD_SAFE /* True if the current process might be multi-threaded, false if it is definitely single-threaded. @@ -98,24 +106,25 @@ extern int __isthreaded; static bool is_threaded(void) { -# if THREAD_PREFER_SINGLE && HAVE___ISTHREADED +# if THREAD_PREFER_SINGLE && HAVE___ISTHREADED return !!__isthreaded; -# elif THREAD_PREFER_SINGLE && HAVE_SYS_SINGLE_THREADED_H +# elif THREAD_PREFER_SINGLE && HAVE_SYS_SINGLE_THREADED_H return !__libc_single_threaded; -# else +# else return true; -# endif +# endif } -# if THREAD_RWLOCK +# if THREAD_RWLOCK static pthread_rwlock_t locallock = PTHREAD_RWLOCK_INITIALIZER; static int dolock(void) { return pthread_rwlock_rdlock(&locallock); } static void dounlock(void) { pthread_rwlock_unlock(&locallock); } -# else +# else static pthread_mutex_t locallock = PTHREAD_MUTEX_INITIALIZER; static int dolock(void) { return pthread_mutex_lock(&locallock); } static void dounlock(void) { pthread_mutex_unlock(&locallock); } -# endif +# endif + /* Get a lock. Return 0 on success, a positive errno value on failure, negative if known to be single-threaded so no lock is needed. */ static int @@ -131,25 +140,12 @@ unlock(bool threaded) if (threaded) dounlock(); } -#else +# else static int lock(void) { return -1; } static void unlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) { } +# endif #endif -/* If THREADED, upgrade a read lock to a write lock. - Return 0 on success, a positive errno value otherwise. */ -static int -rd2wrlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) -{ -#if THREAD_RWLOCK - if (threaded) { - dounlock(); - return pthread_rwlock_wrlock(&locallock); - } -#endif - return 0; -} - #if THREAD_SAFE typedef pthread_once_t once_t; # define ONCE_INIT PTHREAD_ONCE_INIT @@ -187,36 +183,6 @@ tm_multi_key_init(void) #endif -/* Return TMP, or a thread-specific struct tm * selected by WHICH. */ -static struct tm * -tm_multi(struct tm *tmp, ATTRIBUTE_MAYBE_UNUSED enum tm_multi which) -{ -#if THREAD_SAFE && THREAD_TM_MULTI - /* It is OK to check is_threaded() separately here; even if it - returns a different value in other places in the caller, - this function's behavior is still valid. */ - if (is_threaded()) { - /* Try to get a thread-specific struct tm *. - Fall back on TMP if this fails. */ - static pthread_once_t tm_multi_once = PTHREAD_ONCE_INIT; - pthread_once(&tm_multi_once, tm_multi_key_init); - if (!tm_multi_key_err) { - struct tm *p = pthread_getspecific(tm_multi_key); - if (!p) { - p = malloc(N_TM_MULTI * sizeof *p); - if (p && pthread_setspecific(tm_multi_key, p) != 0) { - free(p); - p = NULL; - } - } - if (p) - return &p[which]; - } - } -#endif - return tmp; -} - /* Unless intptr_t is missing, pacify gcc -Wcast-qual on char const * exprs. Use this carefully, as the casts disable type checking. This is a macro so that it can be used in static initializers. */ @@ -293,9 +259,6 @@ typedef time_t monotime_t; to a static function that returns the redefined time_t. It also tells us to define only data and code needed to support the offtime or mktime variant. */ -#ifndef USE_TIMEX_T -# define USE_TIMEX_T false -#endif #if USE_TIMEX_T # undef TIME_T_MIN # undef TIME_T_MAX @@ -1843,6 +1806,20 @@ zoneinit(struct state *sp, char const *name, char tzloadflags) } } +/* If THREADED, upgrade a read lock to a write lock. + Return 0 on success, a positive errno value otherwise. */ +static int +rd2wrlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) +{ +# if THREAD_RWLOCK + if (threaded) { + dounlock(); + return pthread_rwlock_wrlock(&locallock); + } +# endif + return 0; +} + /* Like tzset(), but in a critical section. If THREADED && THREAD_RWLOCK the caller has a read lock, and this function might upgrade it to a write lock. @@ -2134,6 +2111,36 @@ localsub(struct state const *sp, time_t const *timep, int_fast32_t setname, #if !USE_TIMEX_T +/* Return TMP, or a thread-specific struct tm * selected by WHICH. */ +static struct tm * +tm_multi(struct tm *tmp, ATTRIBUTE_MAYBE_UNUSED enum tm_multi which) +{ +# if THREAD_SAFE && THREAD_TM_MULTI + /* It is OK to check is_threaded() separately here; even if it + returns a different value in other places in the caller, + this function's behavior is still valid. */ + if (is_threaded()) { + /* Try to get a thread-specific struct tm *. + Fall back on TMP if this fails. */ + static pthread_once_t tm_multi_once = PTHREAD_ONCE_INIT; + pthread_once(&tm_multi_once, tm_multi_key_init); + if (!tm_multi_key_err) { + struct tm *p = pthread_getspecific(tm_multi_key); + if (!p) { + p = malloc(N_TM_MULTI * sizeof *p); + if (p && pthread_setspecific(tm_multi_key, p) != 0) { + free(p); + p = NULL; + } + } + if (p) + return &p[which]; + } + } +# endif + return tmp; +} + # if NETBSD_INSPIRED struct tm * localtime_rz(struct state *restrict sp, time_t const *restrict timep, -- 2.52.0

1 0