* lib/strftime.c (__strftime_internal):
Check for result overflow if the padding is too large,
which can happen only with fprintftime.
---
 ChangeLog      | 5 +++++
 lib/strftime.c | 6 +++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 524957585f..14f4d37b39 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
 2025-10-30  Paul Eggert  <[email protected]>
 
+       fprintftime: check for overflow due to padding
+       * lib/strftime.c (__strftime_internal):
+       Check for result overflow if the padding is too large,
+       which can happen only with fprintftime.
+
        fprintftime: sbyte_count_t to fix some overflows
        * lib/strftime.c: Include <stdint.h>, for PTRDIFF_MAX.
        (byte_count_t): Now a typedef instead of a macro.
diff --git a/lib/strftime.c b/lib/strftime.c
index 4c3ae7b984..e29cd32666 100644
--- a/lib/strftime.c
+++ b/lib/strftime.c
@@ -1891,7 +1891,11 @@ __strftime_internal (STREAM_OR_CHAR_T *s, STRFTIME_ARG 
(size_t maxsize)
                   {
                     if (p)
                       memset_space (p, padding);
-                    i += padding;
+                    if (ckd_add (&i, i, padding) && FPRINTFTIME)
+                      {
+                        errno = ERANGE;
+                        return 0;
+                      }
                     width -= padding;
                   }
                 width_add1 (0, sign_char);
-- 
2.51.0


Reply via email to