bug#79705: denial of service bug in date(1)

Paul Eggert <[email protected]>
Newsgroups gmane.comp.gnu.core-utils.bugs
Organization UCLA Computer Science Department
Message-ID <[email protected]> 
On 2025-10-26 15:07, Jeff Epler wrote:
> It is possible to specify a date format string that will produce truly unreasonable amounts of output:
Whatever limit 'date' would impose, there'd be someone wanting to go 
over that limit. We won't impose an arbitrary limit like 255 for that 
reason. This is specified by the GNU Coding Standards[1].

PS. It's not a denial of service bug. One should not let an adversary 
specify an arbitrary 'date' format. Similarly, Python does not have a 
denial of service bug merely because a naive developer could let an 
adversary specify an arbitrary Python program.

[1]: https://www.gnu.org/prep/standards/html_node/Semantics.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.