Clive D.W. Feather wrote:
In this case, the resulting string could be anything but it must still be a string and the call can't break anything else.
Yes, and tzcode substitutes "?" for some values out of range, e.g., month names when tm_mon < 0. This behavior is common in other implementations. Alternatively, strftime could simply return 0, pretending that the resulting string is infinitely long. The trickiest issue here is when tm_year < 1 - 1900, that is, before Gregorian year 1. Although C11 and POSIX-2017 say that strftime must produce a decimal number, they don't say what the number should be. tzcode, like all other implementations I know of, says the years before year 1 are years 0, -1, -2, .... This follows the astronomical tradition used by Kepler and popularized by Cassini <https://en.wikipedia.org/wiki/Astronomical_year_numbering>.