Subject: bug#16872: closed (Re: bug#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 27 Feb 2014 23:59:03 +0000

Your bug report

#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
16872: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes
From: Pádraig Brady <[email-masked]>
To: Bernhard Voelker <[email-masked]>
Cc: bug-gnulib <[email-masked]>, Mike Frysinger <[email-masked]>, [email-masked]
Date: Thu, 27 Feb 2014 23:58:33 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

On 02/27/2014 09:48 PM, Bernhard Voelker wrote:
> On 02/25/2014 12:11 PM, Pádraig Brady wrote:
>> Proposed patch attached.
> 
> parse_datetime per se is pretty ugly, however, the fix LGTM:
> +1

I've pushed that to gnulib,
and the attached to coreutils.

thanks for the review,
Pádraig.

>From a4faa6a0a3ae93c01d036d830ae7a21b74913baf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <[email-masked]>
Date: Thu, 27 Feb 2014 23:43:34 +0000
Subject: [PATCH] date: fix crash or infinite loop when parsing a malformed
 TZ=""

* NEWS: Mention the fix.
* gnulib: Update to incorporate the fix.
This is the only change in this gnulib update.
* tests/misc/date.pl: Add a test for this case.

Fixes http://bugs.gnu.org/16872
---
 NEWS               |    3 +++
 gnulib             |    2 +-
 tests/misc/date.pl |    7 +++++++
 3 files changed, 11 insertions(+), 1 deletions(-)

diff --git a/NEWS b/NEWS
index be8311f..d867784 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ GNU coreutils NEWS                                    -*- outline -*-
   when reading the SELinux context for a file.
   [bug introduced in coreutils-8.22]
 
+  date could crash or go into an infinite loop when parsing a malformed TZ="".
+  [bug introduced with the --date='TZ="" ..' parsing feature in coreutils-5.3.0]
+
   head --lines=-0, when the input does not contain a trailing '\n',
   now copies all input to stdout.  Previously nothing was output in this case.
   [bug introduced with the --lines=-N feature in coreutils-5.0.1]
diff --git a/gnulib b/gnulib
index 1c6bf3d..a10acfb 160000
--- a/gnulib
+++ b/gnulib
@@ -1 +1 @@
-Subproject commit 1c6bf3d204c0cbd664590bbdc30fdf756d9fdb65
+Subproject commit a10acfb1d2118f9a180181d3fed5399dbbe1df3c
diff --git a/tests/misc/date.pl b/tests/misc/date.pl
index 57c6c72..40be4ca 100755
--- a/tests/misc/date.pl
+++ b/tests/misc/date.pl
@@ -287,6 +287,13 @@ my @Tests =
       {ERR => "date: invalid date '\\260'\n"},
       {EXIT => 1},
      ],
+
+     # From coreutils-5.3.0 to 8.22 inclusive
+     # this would either infinite loop or crash
+     ['invalid-TZ-crash', "-d 'TZ=\"\"\"'",
+      {ERR => "date: invalid date 'TZ=\"\"\"'\n"},
+      {EXIT => 1},
+     ],
     );
 
 # Repeat the cross-dst test, using Jan 1, 2005 and every interval from 1..364.
-- 
1.7.7.6

Subject: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes
From: Mike Frysinger <[email-masked]>
To: [email-masked]
Date: Tue, 25 Feb 2014 03:13:52 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

as reported by Bertrand Jacquin, this crashes:
$ date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'
Segmentation fault

(gdb) bt
#0  0x00007ffff7ab1014 in __GI___libc_free (mem=0x7fffffffc8b0) at malloc.c:2942
#1  0x0000000000406730 in parse_datetime (result=result@entry=0x7fffffffcab0, p=<optimized out>, p@entry=0x7fffffffd04a "TZ=\"America/Los_Angeles\" \"00:00 + 1 hour\"", now=<optimized out>, now
@entry=0x0) at ./lib/parse-datetime.y:1307
#2  0x00000000004023c7 in main (argc=0x3, argv=0x7fffffffcc68) at src/date.c:522

that's 15fca2a02e38d69915c52ef41eee3c7d52b67f3e i happened to have already
built, but seems to reproduce easily across older versions.
-mike