bug#79705: denial of service bug in date(1)
"Jeff Epler" <[email protected]>
| Newsgroups | gmane.comp.gnu.core-utils.bugs |
|---|---|
| Message-ID | <[email protected]> |
It is possible to specify a date format string that will produce truly unreasonable amounts of output:
$ date +`python -c 'print("%2147483648c" * 10000)'`
(the format string here is 10,000 repetitions of "%2147483648c"). This will produce around 20,000GiB of output (20TiB). On my system, producing 10 repetitions takes 33 seconds, so the full 10,000 would take about 9 hours. A repetition factor of 11000 did not work on my system due to the operating system limitation on the total size of arguments.
I noticed that another implementation of time (uutils) caps the field width of any given "resource specifier" at 255 characters, meaning that the biggest length of output is probably under 10MiB (but still a non trivial amount of output)
Jeff