diff options
| author | Lennart Poettering <lennart@poettering.net> | 2017-02-02 18:30:29 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2017-02-02 20:12:31 +0100 |
| commit | 1bb4b028a380d74cff6399ea1d8ffcf1b2f122bc (patch) | |
| tree | 041f20a932fbf9d318cf5484bf5e22e8cddae5bc /src/basic/time-util.c | |
| parent | c477ff141b875a2a98c90514b6bf23f0436d1f73 (diff) | |
time-util: refuse formatting/parsing times that we can't store
usec_t is always 64bit, which means it can cover quite a number of
years. However, 4 digit year display and glibc limitations around time_t
limit what we can actually parse and format. Let's make this explicit,
so that we never end up formatting dates we can#t parse and vice versa.
Note that this is really just about formatting/parsing. Internal
calculations with times outside of the formattable range are not
affected.
Diffstat (limited to 'src/basic/time-util.c')
| -rw-r--r-- | src/basic/time-util.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/basic/time-util.c b/src/basic/time-util.c index 2b44cdf0b1..eefbf90923 100644 --- a/src/basic/time-util.c +++ b/src/basic/time-util.c @@ -287,9 +287,11 @@ static char *format_timestamp_internal( if (t <= 0 || t == USEC_INFINITY) return NULL; /* Timestamp is unset */ + /* Let's not format times with years > 9999 */ + if (t > USEC_TIMESTAMP_FORMATTABLE_MAX) + return NULL; + sec = (time_t) (t / USEC_PER_SEC); /* Round down */ - if ((usec_t) sec != (t / USEC_PER_SEC)) - return NULL; /* overflow? */ if (!localtime_or_gmtime_r(&sec, &tm, utc)) return NULL; @@ -836,9 +838,14 @@ from_tm: return -EINVAL; ret = (usec_t) x * USEC_PER_SEC + x_usec; + if (ret > USEC_TIMESTAMP_FORMATTABLE_MAX) + return -EINVAL; finish: ret += plus; + if (ret > USEC_TIMESTAMP_FORMATTABLE_MAX) + return -EINVAL; + if (ret > minus) ret -= minus; else |