[Bug time/34538] New: strftime uses wrong length internally for very large time zone names

https://sourceware.org/bugzilla/show_bug.cgi?id=34538

            Bug ID: 34538
           Summary: strftime uses wrong length internally for very large
                    time zone names
           Product: glibc
           Version: 2.29
            Status: NEW
          Severity: normal
          Priority: P2
         Component: time
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

Created attachment 16951
  --> https://sourceware.org/bugzilla/attachment.cgi?id=16951&action=edit
RHEL-215023.html

Red Hat Product Security has asked me to forward the attached report.

The issue is that internally, strftime assigns the result of strlen to an int
variable.


I disagree with the classification of this as a security bug in the report.
Both format strings and time zone names pretty much always come from trusted
data sources, so this does not cross any trust boundary. Nevertheless, I'm
required to mention: Found by AISLE in partnership with Red Hat

-- 
You are receiving this mail because:
You are on the CC list for the bug.