shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-03-10 00:58:20 +03:00
Code

basic/calendarspec: fix assert crash when year is too large in calendarspec_from_time_t()

Browse Source 
gmtime_r() will return NULL in that case, and we would crash.

I committed the reproducer case in fuzz-regressions/, even though we don't have
ubsan hooked up yet. Let's add it anyway in case it is useful in the future. We
actually crash anyway when compiled with asserts, so this can be easily
reproduced without ubsan.

oss-fuzz #6886.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2018-03-13 12:51:08 +01:00
parent 20d52ab60e
commit 55a30fd4e8
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/basic/calendarspec.c
View File

@ -581,7 +581,8 @@ static int calendarspec_from_time_t(CalendarSpec *c, time_t time) {
CalendarComponent *year = NULL, *month = NULL, *day = NULL, *hour = NULL, *minute = NULL, *us = NULL;
int r;
assert_se(gmtime_r(&time, &tm));
if (!gmtime_r(&time, &tm))
return -ERANGE;
r = const_chain(tm.tm_year + 1900, &year);
if (r < 0)

3
test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6886 Normal file
View File

@ -0,0 +1,3 @@
timer
[Timer]
OnCalendar=@88588582097858858

1
test/fuzz-regressions/meson.build
View File

@ -31,4 +31,5 @@ fuzz_regression_tests = '''
fuzz-dns-packet/issue-7888
fuzz-unit-file/oss-fuzz-6884
fuzz-unit-file/oss-fuzz-6885
fuzz-unit-file/oss-fuzz-6886
'''.split()