On 28/10/2026 21:12, Pádraig Brady wrote:
On 28/10/2026 12:36, CHEN LINGFENG wrote:
Dear maintainer,
Thank you for your work on maintaining GNU Coreutils.
I would like to report a potential security issue in pr. A specially crafted -D
date format can cause an integer wraparound in nstrftime, resulting in an
extremely large size being passed to memset.
The issue is still reproducible on the latest Coreutils 9.12 release.
Minimal reproducer
pr -D'%+_1z' /dev/null
That even crashes without ASAN.
A possible fix would be to calculate shortage using the signed sbyte_count_t
type before determining the padding size.
Yes, that looks like a correct fix, since all the other types in the expression
are signed.
There is another related issue I noticed a few lines below that
where padding limit isn't checked before writing.
That can be triggered with:
ls -l --time-style='+%_10000z' /dev/null
It looks like we can just use incr_overflow() to avoid that,
and move the memset after that check.
It seems the padding limit check was inadvertently removed in commit
1c740444c922.
We'll fix these 2 issues up in gnulib.
There were actually two more related issues.
All 4 fixes are now pushed to gnulib.
I'll push the attached soon to doc/test it from the coreutils side.
Marking this as done.
Thanks again,
Padraig
From ffe259c1f2b9ce9d1f1cd077446835b34e127e38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <[email protected]>
Date: Fri, 30 Oct 2026 17:31:26 +0000
Subject: [PATCH] tests: add checks for recent strftime fixes
Add docs and tests for the recent gnulib strftime fixes.
* tests/misc/strftime.sh: Add a new test.
* tests/local.mk: Reference the new test.
* NEWS: Mention the bug fixes.
Fixes https://bugs.gnu.org/82130
---
NEWS | 5 +++++
tests/local.mk | 1 +
tests/misc/strftime.sh | 41 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 47 insertions(+)
create mode 100755 tests/misc/strftime.sh
diff --git a/NEWS b/NEWS
index 6b4d6855e..63fda2720 100644
--- a/NEWS
+++ b/NEWS
@@ -153,6 +153,11 @@ GNU coreutils NEWS -*- outline -*-
into a seekable file whose size is a multiple of the page size.
[bug introduced in coreutils-8.24]
+ Utilities that accept user supplied date formatting;
+ 'date', 'du', 'dir', 'vdir', 'ls', and 'pr' no longer have buffer overflows
+ when processing with gnulib's strftime replacement.
+ [bugs introduced in coreutils-8.32 and coreutils-9.9]
+
When configured with both --disable-bold-man-page-references and
--disable-manual-url, 'chroot', 'head', 'shred', 'sort', 'split', and 'tail'
no longer use an uninitialized va_list when printing --help. Previously, they
diff --git a/tests/local.mk b/tests/local.mk
index 957cd9446..8f206b88d 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -189,6 +189,7 @@ all_tests = \
tests/misc/no-fork.sh \
tests/misc/exec-bad-unicode.sh \
tests/misc/proc-self-comm.sh \
+ tests/misc/strftime.sh \
tests/misc/traversal-missing.sh \
tests/misc/tty-quoting.sh \
tests/misc/uname-labeled.sh \
diff --git a/tests/misc/strftime.sh b/tests/misc/strftime.sh
new file mode 100755
index 000000000..4be1d1690
--- /dev/null
+++ b/tests/misc/strftime.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+# test strftime edge cases from https://bugs.gnu.org/82130
+
+# Copyright (C) 2026 Free Software Foundation, Inc.
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
+print_ver_ date ls pr
+getlimits_
+
+# Check gnulib commit 05812ed5
+returns_ 1 date -d @0 "+%${SSIZE_OFLOW}Y" 2>err || fail=1
+printf 'date: fprintftime error: %s\n' "$ERANGE" >exp-err || framework_failure_
+compare exp-err err || fail=1
+
+# Check gnulib commit 8017c478
+ls -ld --time-style='+%504F' . >out || fail=1
+test "$(tr -cd '0' < out | wc -c)" -ge 400 || fail=1
+
+# Check gnulib commit 8189e652
+ls -ld --time-style='+%_10000z' . || fail=1
+
+# Check gnulib commit 197a7b31
+# Note this requires ASAN to trigger with accelerated memset
+ls -ld --time-style='+%_1z' . || fail=1
+# Note this does not require ASAN to trigger
+pr -D'%_1z' /dev/null || fail=1
+
+Exit $fail
--
2.56.0
