libc difftime() miscomputes negative representable time_t values on amd64

Xuntao Chi <[email protected]>
Newsgroups gmane.os.openbsd.bugs
Message-ID <[email protected]> 
>Synopsis:	libc difftime() miscomputes negative representable time_t values
>Category:	library
>Environment:
	System      : OpenBSD 7.8
	Details     : OpenBSD 7.8 (GENERIC.MP) #6: Fri Mar 20 10:18:39 MDT 2026
			 
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP

	Architecture: OpenBSD.amd64
	Machine     : amd64
>Description:
	On this amd64 system, time_t is a signed 64-bit type, but libc
	difftime() appears to miscompute when one operand is a negative
	but representable time_t value.

	A minimal example:

		difftime((time_t)0, (time_t)-86400)

	should return 86400, but instead returns a huge wrapped negative
	value.

	On this host I observed output equivalent to:

		-18446744073709465600

	This also affects real applications. For example, GNU findutils
	constructs negative synthetic time_t values internally for the
	-used predicate, and on this host that leads to incorrect results
	for cases where access time and change time are equal.

	The likely cause appears to be the current libc implementation in
	lib/libc/time/difftime.c:

		#define HI(t) ((double)(t & 0xffffffff00000000LL))
		#define LO(t) ((double)(t & 0x00000000ffffffffLL))
		return (HI(t1) - HI(t0)) + (LO(t1) - LO(t0));

	For signed negative time_t values, masking the bits this way seems
	to treat the value as an unsigned 64-bit quantity.
>How-To-Repeat:
	Run the following on OpenBSD/amd64:

		cat >/tmp/test-difftime.c <<'EOF'
		#include <stdio.h>
		#include <time.h>

		int
		main(void)
		{
			printf("sizeof(time_t)=%zu\n", sizeof(time_t));
			printf("difftime(0, -86400) = %.0f\n",
			    difftime((time_t)0, (time_t)-86400));
			return 0;
		}
		EOF
		cc -O0 -g /tmp/test-difftime.c -o /tmp/test-difftime
		/tmp/test-difftime

	On my system this prints:

		sizeof(time_t)=8
		difftime(0, -86400) = -18446744073709465600

	The expected result is:

		difftime(0, -86400) = 86400
>Fix:
	I do not have a tested patch, but the current implementation in
	lib/libc/time/difftime.c appears to mishandle signed negative
	time_t values due to the bitmask-based HI/LO decomposition.

	A simple reproducer suggests the issue is in difftime() itself,
	not in the caller.

	A libc regression test for negative representable time_t inputs
	to difftime() would likely catch this.

dmesg:
OpenBSD 7.8 (GENERIC.MP) #6: Fri Mar 20 10:18:39 MDT 2026
  [email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 4240166912 (4043MB)
avail mem = 4084989952 (3895MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.7 @ 0xbfbfb020 (175 entries)
bios0: vendor VMware, Inc. version "VMW201.00V.24006586.B64.2406042154" 
date 06/04/2024
bios0: VMware, Inc. VMware20,1
efi0 at bios0: UEFI 2.7
efi0: VMware, Inc. rev 0x10000
acpi0 at bios0: ACPI 4.0
acpi0: sleep states S0 S1 S4 S5
acpi0: tables DSDT SRAT FACP APIC MCFG HPET WAET WSMT
acpi0: wakeup devices PCI0(S3) USB_(S1) P2P0(S3) S1F0(S3) S2F0(S3) 
S8F0(S3) S16F(S3) S17F(S3) S18F(S3) S22F(S3) S23F(S3) S24F(S3) S25F(S3) 
PE40(S3) S1F0(S3) PE41(S3) [...]
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: 12th Gen Intel(R) Core(TM) i7-12700H, 2688.07 MHz, 06-9a-03
cpu0: cpuid 1 
edx=1f8bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,MMX,FXSR,SSE,SSE2,SS,HTT> 
ecx=f7fa3203<SSE3,PCLMUL,SSSE3,FMA3,CX16,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,DEADLINE,AES,XSAVE,AVX,F16C,RDRAND,HV>
cpu0: cpuid 6 eax=4<ARAT>
cpu0: cpuid 7.0 
ebx=219c27eb<FSGSBASE,TSC_ADJUST,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,RDSEED,ADX,SMAP,CLFLUSHOPT,CLWB,SHA> 
ecx=9840078c<UMIP,PKU,PKS> edx=bc004410<MD_CLEAR,IBRS,IBPB,STIBP,L1DF,SSBD>
cpu0: cpuid a vers=1, gp=6, gpwidth=48
cpu0: cpuid d.1 eax=f<XSAVEOPT,XSAVEC,XGETBV1,XSAVES>
cpu0: cpuid 80000001 edx=2c100800<NXE,PAGE1GB,RDTSCP,LONG> 
ecx=121<LAHF,ABM,3DNOWP>
cpu0: cpuid 80000007 edx=100<ITSC>
cpu0: msr 10a=8002b<IBRS_ALL,SKIP_L1DFL,MDS_NO,RRSBA>
cpu0: 48KB 64b/line 12-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 
64b/line 10-way L2 cache, 24MB 64b/line 12-way L3 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 66MHz
cpu1 at mainbus0: apid 1 (application processor)
cpu1: 12th Gen Intel(R) Core(TM) i7-12700H, 2688.05 MHz, 06-9a-03
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 2 (application processor)
cpu2: 12th Gen Intel(R) Core(TM) i7-12700H, 2688.07 MHz, 06-9a-03
cpu2: smt 0, core 2, package 0
cpu3 at mainbus0: apid 3 (application processor)
cpu3: 12th Gen Intel(R) Core(TM) i7-12700H, 2688.04 MHz, 06-9a-03
cpu3: smt 0, core 3, package 0
ioapic0 at mainbus0: apid 4 pa 0xfec00000, version 20, 24 pins, remapped
acpimcfg0 at acpi0
acpimcfg0: addr 0xe0000000, bus 0-127
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpipci0 at acpi0 PCI0: 0x00000000 0x00000011 0x00000001
acpicmos0 at acpi0
"PNP0303" at acpi0 not configured
"VMW0003" at acpi0 not configured
"PNP0A05" at acpi0 not configured
acpiac0 at acpi0: AC unit online
acpicpu0 at acpi0: C1(@1 halt!)
acpicpu1 at acpi0: C1(@1 halt!)
acpicpu2 at acpi0: C1(@1 halt!)
acpicpu3 at acpi0: C1(@1 halt!)
pvbus0 at mainbus0: VMware
vmt0 at pvbus0
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel 82443BX AGP" rev 0x01
ppb0 at pci0 dev 1 function 0 "Intel 82443BX AGP" rev 0x01
pci1 at ppb0 bus 1
pcib0 at pci0 dev 7 function 0 "Intel 82371AB PIIX4 ISA" rev 0x08
pciide0 at pci0 dev 7 function 1 "Intel 82371AB IDE" rev 0x01: DMA, 
channel 0 configured to compatibility, channel 1 configured to compatibility
pciide0: channel 0 disabled (no drives)
atapiscsi0 at pciide0 channel 1 drive 0
scsibus1 at atapiscsi0: 2 targets
cd0 at scsibus1 targ 0 lun 0: <NECVMWar, VMware IDE CDR10, 1.00> removable
cd0(pciide0:1:0): using PIO mode 4, Ultra-DMA mode 2
piixpm0 at pci0 dev 7 function 3 "Intel 82371AB Power" rev 0x08: SMBus 
disabled
"VMware VMCI" rev 0x10 at pci0 dev 7 function 7 not configured
"VMware SVGA II" rev 0x00 at pci0 dev 15 function 0 not configured
mpi0 at pci0 dev 16 function 0 "Symbios Logic 53c1030" rev 0x01: apic 4 
int 17
mpi0: 0, firmware 1.3.41.32
scsibus2 at mpi0: 16 targets, initiator 7
sd0 at scsibus2 targ 0 lun 0: <VMware,, VMware Virtual S, 1.0>
sd0: 122880MB, 512 bytes/sector, 251658240 sectors
mpi0: target 0 Sync at 160MHz width 16bit offset 127 QAS 1 DT 1 IU 1
ppb1 at pci0 dev 17 function 0 "VMware PCI" rev 0x02
pci2 at ppb1 bus 2
uhci0 at pci2 dev 0 function 0 "VMware UHCI" rev 0x00: apic 4 int 18
em0 at pci2 dev 1 function 0 "Intel 82545EM" rev 0x01: apic 4 int 19, 
address 00:0c:29:99:bf:b3
eap0 at pci2 dev 2 function 0 "Ensoniq AudioPCI97" rev 0x02: apic 4 int 16
ac97: codec id 0x43525913 (Cirrus Logic CS4297A rev 3)
audio0 at eap0
midi0 at eap0: <AudioPCI MIDI UART>
ehci0 at pci2 dev 3 function 0 "VMware EHCI" rev 0x00: apic 4 int 17
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 configuration 1 interface 0 "VMware EHCI root hub" rev 
2.00/1.00 addr 1
usb1 at uhci0: USB revision 1.0
uhub1 at usb1 configuration 1 interface 0 "VMware UHCI root hub" rev 
1.00/1.00 addr 1
ppb2 at pci0 dev 21 function 0 "VMware PCIE" rev 0x01: msi
pci3 at ppb2 bus 3
xhci0 at pci3 dev 0 function 0 vendor "VMware", unknown product 0x077a 
rev 0x00: msix, xHCI 1.20
usb2 at xhci0: USB revision 3.0
uhub2 at usb2 configuration 1 interface 0 "VMware xHCI root hub" rev 
3.00/1.00 addr 1
ppb3 at pci0 dev 21 function 1 "VMware PCIE" rev 0x01: msi
pci4 at ppb3 bus 4
ppb4 at pci0 dev 21 function 2 "VMware PCIE" rev 0x01: msi
pci5 at ppb4 bus 5
ppb5 at pci0 dev 21 function 3 "VMware PCIE" rev 0x01: msi
pci6 at ppb5 bus 6
ppb6 at pci0 dev 21 function 4 "VMware PCIE" rev 0x01: msi
pci7 at ppb6 bus 7
ppb7 at pci0 dev 21 function 5 "VMware PCIE" rev 0x01: msi
pci8 at ppb7 bus 8
ppb8 at pci0 dev 21 function 6 "VMware PCIE" rev 0x01: msi
pci9 at ppb8 bus 9
ppb9 at pci0 dev 21 function 7 "VMware PCIE" rev 0x01: msi
pci10 at ppb9 bus 10
ppb10 at pci0 dev 22 function 0 "VMware PCIE" rev 0x01: msi
pci11 at ppb10 bus 11
ppb11 at pci0 dev 22 function 1 "VMware PCIE" rev 0x01: msi
pci12 at ppb11 bus 12
ppb12 at pci0 dev 22 function 2 "VMware PCIE" rev 0x01: msi
pci13 at ppb12 bus 13
ppb13 at pci0 dev 22 function 3 "VMware PCIE" rev 0x01: msi
pci14 at ppb13 bus 14
ppb14 at pci0 dev 22 function 4 "VMware PCIE" rev 0x01: msi
pci15 at ppb14 bus 15
ppb15 at pci0 dev 22 function 5 "VMware PCIE" rev 0x01: msi
pci16 at ppb15 bus 16
ppb16 at pci0 dev 22 function 6 "VMware PCIE" rev 0x01: msi
pci17 at ppb16 bus 17
ppb17 at pci0 dev 22 function 7 "VMware PCIE" rev 0x01: msi
pci18 at ppb17 bus 18
ppb18 at pci0 dev 23 function 0 "VMware PCIE" rev 0x01: msi
pci19 at ppb18 bus 19
ppb19 at pci0 dev 23 function 1 "VMware PCIE" rev 0x01: msi
pci20 at ppb19 bus 20
ppb20 at pci0 dev 23 function 2 "VMware PCIE" rev 0x01: msi
pci21 at ppb20 bus 21
ppb21 at pci0 dev 23 function 3 "VMware PCIE" rev 0x01: msi
pci22 at ppb21 bus 22
ppb22 at pci0 dev 23 function 4 "VMware PCIE" rev 0x01: msi
pci23 at ppb22 bus 23
ppb23 at pci0 dev 23 function 5 "VMware PCIE" rev 0x01: msi
pci24 at ppb23 bus 24
ppb24 at pci0 dev 23 function 6 "VMware PCIE" rev 0x01: msi
pci25 at ppb24 bus 25
ppb25 at pci0 dev 23 function 7 "VMware PCIE" rev 0x01: msi
pci26 at ppb25 bus 26
ppb26 at pci0 dev 24 function 0 "VMware PCIE" rev 0x01: msi
pci27 at ppb26 bus 27
ppb27 at pci0 dev 24 function 1 "VMware PCIE" rev 0x01: msi
pci28 at ppb27 bus 28
ppb28 at pci0 dev 24 function 2 "VMware PCIE" rev 0x01: msi
pci29 at ppb28 bus 29
ppb29 at pci0 dev 24 function 3 "VMware PCIE" rev 0x01: msi
pci30 at ppb29 bus 30
ppb30 at pci0 dev 24 function 4 "VMware PCIE" rev 0x01: msi
pci31 at ppb30 bus 31
ppb31 at pci0 dev 24 function 5 "VMware PCIE" rev 0x01: msi
pci32 at ppb31 bus 32
ppb32 at pci0 dev 24 function 6 "VMware PCIE" rev 0x01: msi
pci33 at ppb32 bus 33
ppb33 at pci0 dev 24 function 7 "VMware PCIE" rev 0x01: msi
pci34 at ppb33 bus 34
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
wsmouse0 at pms0 mux 0
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
efifb0 at mainbus0: 1920x1080, 32bpp
wsdisplay0 at efifb0 mux 1: console (std, vt100 emulation), using wskbd0
wsdisplay0: screen 1-5 added (std, vt100 emulation)
uhub3 at uhub1 port 2 configuration 1 interface 0 "VMware, Inc. VMware 
Virtual USB Hub" rev 1.10/1.00 addr 2
uhidev0 at uhub2 port 5 configuration 1 interface 0 "VMware VMware 
Virtual USB Mouse" rev 1.10/1.02 addr 2
uhidev0: iclass 3/0
ums0 at uhidev0: 16 buttons, Z and W dir
wsmouse1 at ums0 mux 0
uhidev1 at uhub2 port 5 configuration 1 interface 1 "VMware VMware 
Virtual USB Mouse" rev 1.10/1.02 addr 2
uhidev1: iclass 3/0
ums1 at uhidev1: 16 buttons, Z and W dir
wsmouse2 at ums1 mux 0
vscsi0 at root
scsibus3 at vscsi0: 256 targets
softraid0 at root
scsibus4 at softraid0: 256 targets
root on sd0a (79d4bc0fca29dc4b.a) swap on sd0b dump on sd0b

usbdevs:
Controller /dev/usb0:
addr 01: 15ad:0000 VMware, EHCI root hub
	 high speed, self powered, config 1, rev 1.00
	 driver: uhub0
Controller /dev/usb1:
addr 01: 15ad:0000 VMware, UHCI root hub
	 full speed, self powered, config 1, rev 1.00
	 driver: uhub1
addr 02: 0e0f:0002 VMware, Inc., VMware Virtual USB Hub
	 full speed, self powered, config 1, rev 1.00
	 driver: uhub3
Controller /dev/usb2:
addr 01: 15ad:0000 VMware, xHCI root hub
	 super speed, self powered, config 1, rev 1.00
	 driver: uhub2
addr 02: 0e0f:0003 VMware, VMware Virtual USB Mouse
	 full speed, self powered, config 1, rev 1.02
	 driver: uhidev0
	 driver: uhidev1
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.