- tz - lists.iana.org

[PROPOSED] Support slightly-larger TZif files
by Paul Eggert Jan. 21, 2026

Jan. 21, 2026

* NEWS: Mention this. * localtime.c (tzloadbody): Fix off-by-one errors in tests that mistakenly caused the code to reject TZif files that actually fit. Problem introduced in release 2014g, by my commit 13a277175c603cfb62ae5bdcf26e23faf5619ef1 dated 2014-08-19. --- NEWS | 3 +++ localtime.c | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/NEWS b/NEWS index 71bd91e4..995507f0 100644 --- a/NEWS +++ b/NEWS @@ -43,6 +43,9 @@ Unreleased, experimental changes outlandish but conforming UT offsets or leap second corrections, has also been fixed. (Also reported by Naveed8951.) + localtime.c no longer rejects TZif files that exactly fit in its + internal structures, fixing off-by-one typos introduced in 2014g. + zic no longer generates a no-op transition when simultaneous Rule and Zone changes cancel each other out. This occurs in tzdata only in Asia/Tbilisi on 1997-03-30. diff --git a/localtime.c b/localtime.c index aa9b48ca..698f61bf 100644 --- a/localtime.c +++ b/localtime.c @@ -1018,12 +1018,12 @@ tzloadbody(char const *name, struct state *sp, char tzloadflags, /* Although tzfile(5) currently requires typecnt to be nonzero, support future formats that may allow zero typecnt in files that have a TZ string and no transitions. */ - if (! (0 <= leapcnt && leapcnt < TZ_MAX_LEAPS - && 0 <= typecnt && typecnt < TZ_MAX_TYPES - && 0 <= timecnt && timecnt < TZ_MAX_TIMES - && 0 <= charcnt && charcnt < TZ_MAX_CHARS - && 0 <= ttisstdcnt && ttisstdcnt < TZ_MAX_TYPES - && 0 <= ttisutcnt && ttisutcnt < TZ_MAX_TYPES)) + if (! (0 <= leapcnt && leapcnt <= TZ_MAX_LEAPS + && 0 <= typecnt && typecnt <= TZ_MAX_TYPES + && 0 <= timecnt && timecnt <= TZ_MAX_TIMES + && 0 <= charcnt && charcnt <= TZ_MAX_CHARS + && 0 <= ttisstdcnt && ttisstdcnt <= TZ_MAX_TYPES + && 0 <= ttisutcnt && ttisutcnt <= TZ_MAX_TYPES)) return EINVAL; datablock_size = (timecnt * stored /* ats */ -- 2.51.0

1 0

[PROPOSED 0/3] Leap second overflow bugs
by Paul Eggert Jan. 20, 2026

Jan. 20, 2026

This patch series fixes some bugs involving integer overflow in leap second calculations at runtime. The main problem is with the optional time2posix and posix2time functions; without the patches the functions can crash or loop indefinitely or return completely-wrong answers. With these patches the functions have new, documented behavior: they return (time_t) -1 and set errno to EOVERFLOW when the result is not representable, instead of behaving badly in tricky situations. Given the problems I've been seeing with the leap second runtime code, and given the worry that similar problems remain, and given that the leap second runtime code is rarely used in practice, I'm thinking it may be a good idea to add a compile-time option to disable localtime.c's support for leap seconds. Using the option would shrink the attack surface on tzcode. Paul Eggert (3): Fix theoretical -2**31 leapcorr bug Improve time2posix man page Fix overflow bugs in time2posix and posix2time NEWS | 13 ++++- localtime.c | 90 +++++++++++++++++++++------------- time2posix.3 | 134 ++++++++++++++++++++++++++++++++++----------------- 3 files changed, 156 insertions(+), 81 deletions(-) -- 2.51.0

1 3

[PROPOSED] Check with -Wzero-as-null-pointer-constant
by Paul Eggert Jan. 18, 2026

Jan. 18, 2026

* Makefile (GCC_DEBUG_FLAGS): Omit -Wstringop-truncation, as it’s the default. Add -Wzero-as-null-pointer-constant. --- Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 570518c4..021186fc 100644 --- a/Makefile +++ b/Makefile @@ -380,12 +380,13 @@ GCC_DEBUG_FLAGS = -DGCC_LINT -g3 -O3 \ -Wold-style-definition -Woverlength-strings -Wpointer-arith \ -Wshadow -Wshift-overflow=2 -Wstrict-overflow \ -Wstrict-prototypes -Wstringop-overflow=4 \ - -Wstringop-truncation -Wsuggest-attribute=cold \ + -Wsuggest-attribute=cold \ -Wsuggest-attribute=const -Wsuggest-attribute=format \ -Wsuggest-attribute=malloc \ -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure \ -Wtrampolines -Wundef -Wunused-macros -Wuse-after-free=3 \ -Wvariadic-macros -Wvla -Wwrite-strings \ + -Wzero-as-null-pointer-constant \ -Wno-format-nonliteral -Wno-sign-compare -Wno-type-limits # # If your system has a "GMT offset" field in its "struct tm"s -- 2.51.0

1 0

[PROPOSED] Simplify int_fast32_t definition on C89 platforms
by Paul Eggert Jan. 17, 2026

Jan. 17, 2026

* private.h (int_fast32_t, INT_FAST32_MAX, INT_FAST32_MIN): When PORT_TO_C89 is defined, simplify these fallback definitions by using long rather than attempting to use int on platforms where int suffices. The attempt’s test was too strict: its ‘INT_MAX >> 31 == 0’ should have been ‘INT_MAX >> 30 == 0’. This led to a possible performance bug on C89 platforms where int is 32 bits, as int_fast32_t was defined to be long when int would suffice. C89 platforms are now museum pieces and this code is currently scheduled to be removed in 2029 or so anyway, so it is not worth trying to measure and debug any performance issues. Simplify the definitions instead. That mirrors what is already being done for uint_fast32_t. --- private.h | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/private.h b/private.h index 42a1c892..e8cf9c22 100644 --- a/private.h +++ b/private.h @@ -410,15 +410,9 @@ typedef long long int_fast64_t; # endif # ifndef INT_FAST32_MAX -# if INT_MAX >> 31 == 0 typedef long int_fast32_t; -# define INT_FAST32_MAX LONG_MAX -# define INT_FAST32_MIN LONG_MIN -# else -typedef int int_fast32_t; -# define INT_FAST32_MAX INT_MAX -# define INT_FAST32_MIN INT_MIN -# endif +# define INT_FAST32_MAX LONG_MAX +# define INT_FAST32_MIN LONG_MIN # endif # ifndef INT_LEAST32_MAX -- 2.51.0

1 0

Re: tzload: validate tt_utoff to avoid signed overflow
by Paul Eggert Jan. 16, 2026

Jan. 16, 2026

In <https://github.com/eggert/tz/pull/37> (2026-01-10) the GitHub user Naveed8951 writes: > The TZif specification guarantees that tt_utoff is never INT32_MIN > so that 32-bit clients can safely negate it. However, tzloadbody() > previously accepted unvalidated values from untrusted TZif input. > A malformed or malicious file could therefore trigger signed integer > overflow during later offset arithmetic (e.g., negation for timezone / > altzone or offset-difference calculations), which is undefined behavior > in C. Naveed8951 submitted a patch that would cause localtime.c to reject TZif files containing UT offsets outside the POSIX range -89999..93599 (-24:59:50 .. 25:59:59), the idea being that small offsets like that would not cause overflow. Unfortunately, I think such a change would still allow undefined behavior in some cases, as overflow could still happen when adding a small offset to a large tm_sec or time_t value. Also, Internet RFC 9636 section 3.2 allows (though it discourages) UT offsets outside the POSIX range. So instead, I fixed localtime.c to handle the outlandish offsets correctly. As a special case, localtime.c (and zic.c) now reject a UT offset exactly equal to -2**31, as RFC 9636 does not allow that and it can easily cause trouble in callers that negate a UT offset stored in a 32-bit integer.

1 0

[PROPOSED] Pacify gcc -Wunused-function with 32-bit time_t
by Paul Eggert Jan. 16, 2026

Jan. 16, 2026

* localtime.c (USE_TIMEX_T): Move definition up. (is_threaded, locallock, dolock, dounlock, lock, unlock): Do not define if (defined TM_GMTOFF && USE_TIMEX_T). (rd2wrlock, tm_multi): Move definition down to be closer to use, so that it is nested inside #if and thus defined only when used. --- localtime.c | 117 ++++++++++++++++++++++++++++------------------------ 1 file changed, 62 insertions(+), 55 deletions(-) diff --git a/localtime.c b/localtime.c index a2f92b2a..9b7bbaa9 100644 --- a/localtime.c +++ b/localtime.c @@ -52,6 +52,10 @@ struct stat { char st_ctime, st_dev, st_ino; }; # define THREAD_TM_MULTI 0 #endif +#ifndef USE_TIMEX_T +# define USE_TIMEX_T false +#endif + #if THREAD_SAFE # include <pthread.h> @@ -88,6 +92,10 @@ extern int __isthreaded; # endif # endif # endif +#endif + +#if !defined TM_GMTOFF || !USE_TIMEX_T +# if THREAD_SAFE /* True if the current process might be multi-threaded, false if it is definitely single-threaded. @@ -98,24 +106,25 @@ extern int __isthreaded; static bool is_threaded(void) { -# if THREAD_PREFER_SINGLE && HAVE___ISTHREADED +# if THREAD_PREFER_SINGLE && HAVE___ISTHREADED return !!__isthreaded; -# elif THREAD_PREFER_SINGLE && HAVE_SYS_SINGLE_THREADED_H +# elif THREAD_PREFER_SINGLE && HAVE_SYS_SINGLE_THREADED_H return !__libc_single_threaded; -# else +# else return true; -# endif +# endif } -# if THREAD_RWLOCK +# if THREAD_RWLOCK static pthread_rwlock_t locallock = PTHREAD_RWLOCK_INITIALIZER; static int dolock(void) { return pthread_rwlock_rdlock(&locallock); } static void dounlock(void) { pthread_rwlock_unlock(&locallock); } -# else +# else static pthread_mutex_t locallock = PTHREAD_MUTEX_INITIALIZER; static int dolock(void) { return pthread_mutex_lock(&locallock); } static void dounlock(void) { pthread_mutex_unlock(&locallock); } -# endif +# endif + /* Get a lock. Return 0 on success, a positive errno value on failure, negative if known to be single-threaded so no lock is needed. */ static int @@ -131,25 +140,12 @@ unlock(bool threaded) if (threaded) dounlock(); } -#else +# else static int lock(void) { return -1; } static void unlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) { } +# endif #endif -/* If THREADED, upgrade a read lock to a write lock. - Return 0 on success, a positive errno value otherwise. */ -static int -rd2wrlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) -{ -#if THREAD_RWLOCK - if (threaded) { - dounlock(); - return pthread_rwlock_wrlock(&locallock); - } -#endif - return 0; -} - #if THREAD_SAFE typedef pthread_once_t once_t; # define ONCE_INIT PTHREAD_ONCE_INIT @@ -187,36 +183,6 @@ tm_multi_key_init(void) #endif -/* Return TMP, or a thread-specific struct tm * selected by WHICH. */ -static struct tm * -tm_multi(struct tm *tmp, ATTRIBUTE_MAYBE_UNUSED enum tm_multi which) -{ -#if THREAD_SAFE && THREAD_TM_MULTI - /* It is OK to check is_threaded() separately here; even if it - returns a different value in other places in the caller, - this function's behavior is still valid. */ - if (is_threaded()) { - /* Try to get a thread-specific struct tm *. - Fall back on TMP if this fails. */ - static pthread_once_t tm_multi_once = PTHREAD_ONCE_INIT; - pthread_once(&tm_multi_once, tm_multi_key_init); - if (!tm_multi_key_err) { - struct tm *p = pthread_getspecific(tm_multi_key); - if (!p) { - p = malloc(N_TM_MULTI * sizeof *p); - if (p && pthread_setspecific(tm_multi_key, p) != 0) { - free(p); - p = NULL; - } - } - if (p) - return &p[which]; - } - } -#endif - return tmp; -} - /* Unless intptr_t is missing, pacify gcc -Wcast-qual on char const * exprs. Use this carefully, as the casts disable type checking. This is a macro so that it can be used in static initializers. */ @@ -293,9 +259,6 @@ typedef time_t monotime_t; to a static function that returns the redefined time_t. It also tells us to define only data and code needed to support the offtime or mktime variant. */ -#ifndef USE_TIMEX_T -# define USE_TIMEX_T false -#endif #if USE_TIMEX_T # undef TIME_T_MIN # undef TIME_T_MAX @@ -1843,6 +1806,20 @@ zoneinit(struct state *sp, char const *name, char tzloadflags) } } +/* If THREADED, upgrade a read lock to a write lock. + Return 0 on success, a positive errno value otherwise. */ +static int +rd2wrlock(ATTRIBUTE_MAYBE_UNUSED bool threaded) +{ +# if THREAD_RWLOCK + if (threaded) { + dounlock(); + return pthread_rwlock_wrlock(&locallock); + } +# endif + return 0; +} + /* Like tzset(), but in a critical section. If THREADED && THREAD_RWLOCK the caller has a read lock, and this function might upgrade it to a write lock. @@ -2134,6 +2111,36 @@ localsub(struct state const *sp, time_t const *timep, int_fast32_t setname, #if !USE_TIMEX_T +/* Return TMP, or a thread-specific struct tm * selected by WHICH. */ +static struct tm * +tm_multi(struct tm *tmp, ATTRIBUTE_MAYBE_UNUSED enum tm_multi which) +{ +# if THREAD_SAFE && THREAD_TM_MULTI + /* It is OK to check is_threaded() separately here; even if it + returns a different value in other places in the caller, + this function's behavior is still valid. */ + if (is_threaded()) { + /* Try to get a thread-specific struct tm *. + Fall back on TMP if this fails. */ + static pthread_once_t tm_multi_once = PTHREAD_ONCE_INIT; + pthread_once(&tm_multi_once, tm_multi_key_init); + if (!tm_multi_key_err) { + struct tm *p = pthread_getspecific(tm_multi_key); + if (!p) { + p = malloc(N_TM_MULTI * sizeof *p); + if (p && pthread_setspecific(tm_multi_key, p) != 0) { + free(p); + p = NULL; + } + } + if (p) + return &p[which]; + } + } +# endif + return tmp; +} + # if NETBSD_INSPIRED struct tm * localtime_rz(struct state *restrict sp, time_t const *restrict timep, -- 2.52.0

1 0

[PROPOSED 0/6] Fix integer overflows and drop posixrules
by Paul Eggert Jan. 16, 2026

Jan. 16, 2026

GitHub user Naveed8951 reported a potential (but unlikely) security flaw due to undefined behavior in localtime.c after integer overflow. The patches in this series should fix the reported problems. Some of the problem occurred in a part of the localtime.c code that was implementing a feature declared obsolete in TZDB release 2019b. This feature let the sysadmin specify default DST rules for DST-but-ruleless old-style POSIX settings like TZ="AST4ADT". Rather than try to fix the feature this patch series removes it; the feature is hardly ever used and would stop working in 2038 anyway. As a result, tzcode by default uses current US DST for these settings, with no opportunity for sysadmin override (though the default can be overriden when tzcode is compiled). This behavior is already common elsewhere. Paul Eggert (6): Add comment re UT offsets equal to -2**31 Document zic -p better zic now warns about -p Remove POSIXRULES installation option Remove TZDEFRULES ("posixrules") from localtime.c Fix remaining Naveed8951-reported overflows Makefile | 28 +--- NEWS | 19 +++ localtime.c | 388 ++++++++++++++++++++++++---------------------------- newctime.3 | 4 +- newtzset.3 | 29 +--- tzfile.5 | 7 +- tzfile.h | 12 +- zic.8 | 17 ++- zic.c | 8 ++ 9 files changed, 228 insertions(+), 284 deletions(-) -- 2.52.0

1 6

Unable to find Doha in the database
by Paul Menzel Jan. 14, 2026

Jan. 14, 2026

Dear Time Zone Database folks, Visiting Doha, I wanted to change to its time zone, and knowing `Europe/Berlin`, I looked for *Doha*, but didn’t find it in GNOME [1]. Looking through the Time Zone Database archive, there is in `asia` [3]: # Bahrain # Qatar # Zone NAME STDOFF RULES FORMAT [UNTIL] Zone Asia/Qatar 3:26:08 - LMT 1920 # Al Dawhah / Doha 4:00 - %z 1972 Jun 3:00 - %z The comment is not in my file on Debian though in `/usr/share/zoneinfo/tzdata.zi` from *tzdata* 2025c-3. Z Asia/Qatar 3:26:8 - LMT 1920 4 - %z 1972 Jun 3 - %z Of course, I do not know, if the comment would change anything. Would it be possible to also add Qatar’s capital to the database. Or is there another way to make it easier for people to find the right time zone entry? Kind regards, Paul [1]: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/3656 [2]: https://github.com/eggert/tz/blob/d5f71488fd1ec4a2f7166ceeac2024a677daaaef/…

3 2

[PROPOSED 0/5] Fix some unlikely undefined behaviors
by Paul Eggert Jan. 12, 2026

Jan. 12, 2026

This patchest fixes some bugs in localtime.c when TZif files specify a UT offset equal to -2**31. Such an offset overflows when negated on a 32-bit platform, and this leads to undefined behavior – typically wraparound arithmetic, but the C standard says anything can happen. The patchset also changes zic.c to reject attempts to create such an offset, adjusts some nearby code to be a bit cleaner and more portable. Paul Eggert (5): Omit unnecessary L suffixes zic no longer generates utoff == -2**31 Make sure 2**31 - 1 is signed Port TWOS_COMPLEMENT to signed-magnitude hosts Disallow UT offsets equal to -2**31 NEWS | 4 ++++ localtime.c | 48 ++++++++++++++++++++++++++++++++---------------- private.h | 7 +++++-- strftime.c | 5 +++-- zic.c | 7 ++++--- 5 files changed, 48 insertions(+), 23 deletions(-) -- 2.51.0

1 5

[PROPOSED] Improve .gitignore patterns
by Paul Eggert Jan. 10, 2026

Jan. 10, 2026

* .gitignore: Ignore all subdirectories. Also ignore *.bak, *.core, *.out, *.t, core, and core.*. Also ignore .*, except for .gitignore itself. --- .gitignore | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index e7bb0416..5a140b46 100644 --- a/.gitignore +++ b/.gitignore @@ -1,26 +1,38 @@ # Files intentionally not tracked by Git. # This file is in the public domain. +# +# Ignore all subdirectories. +*/ +# +# Ignore non-directories that are the output of builds, +# or are backups or nonces unlikely to be added to the repository. *.a *.asc +*.bak *.ck -*.ckd/ +*.core *.diff -*.dir/ *.i *.o *.orig +*.out *.patch *.pdf *.ps *.rej *.s +*.t *.tar *.tar.* *.txt *.tzs *.zi *~ +.* +!.gitignore ChangeLog +core +core.* date leapseconds tzdir.h -- 2.51.0

1 0