[bug #51841] find buffer-overflow with -printf '%T+'

Update of bug #51841 (project findutils): Open/Closed:Open => Closed ___ Reply to this item at: ___

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #9, bug #51841 (project findutils): Thanks, pushed - with minor nit in the commit message fixed: - tests: Test more printf format specifiers. + tests: test more printf format specifiers Thanks. ___ Reply to this item

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #8, bug #51841 (project findutils): Hello, set env(TZ) "UTC" indeed works. normal braces, not curly ones. Thanks. Fixed patch attached. (file #41763) ___ Additional Item Attachment: File name:

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #7, bug #51841 (project findutils): Hmm, but this would change the time zone for all tests. This works for me: index 4d0fd28..a1e83de 100644 --- a/find/testsuite/find.gnu/printf.exp +++ b/find/testsuite/find.gnu/printf.exp @@ -3,5 +3,6 @@ exec mkdir tmp exec touch tmp/file

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #6, bug #51841 (project findutils): Well actually there is a simple way: --- a/find/testsuite/Makefile.am +++ b/find/testsuite/Makefile.am @@ -24,6 +24,8 @@ FINDFLAGS = DEJATOOL = find +export TZ = UTC + I'll post an updated patch. cu Andreas

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #5, bug #51841 (project findutils): On 2017-09-06 Bernhard Voelker invalid.nore...@gnu.org wrote: It seems they fail here: -l1 1990-06-22+14:00:00.00 646056000.00 [...] +l1 1990-06-22+12:00:00.00 646056000.00 [...] The expected output for

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #4, bug #51841 (project findutils): Thanks for the tests. It seems they fail here: -l1 1990-06-22+14:00:00.00 646056000.00 [...] +l1 1990-06-22+12:00:00.00 646056000.00 [...] The expected output for '%T+' depends on the local timezone. As the

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #3, bug #51841 (project findutils): Hello, find attached a patch to check %T* (limited to strftime sequences mandated by POSIX), %M, %t, %y, and %Y in the testsuite. Works for me (on Debian GNU/Linux). cu Andreas (file #41718)

[bug #51841] find buffer-overflow with -printf '%T+'

Update of bug #51841 (project findutils): Status:None => Fixed Assigned to:None => berny ___ Follow-up Comment #2: Thanks for the

[bug #51841] find buffer-overflow with -printf '%T+'

Follow-up Comment #1, bug #51841 (project findutils): I think that both the bug and the fix are obvious. After the mentioned patch, the code writes 12 bytes into a stack-allocated array of size 6 bytes: char fmt[6]; // [...] /* Format the main part of the time. */ if (kind == '+')

[bug #51841] find buffer-overflow with -printf '%T+'

URL: Summary: find buffer-overflow with -printf '%T+' Project: findutils Submitted by: ametzler Submitted on: Thu 24 Aug 2017 07:54:37 PM CEST Category: find Severity: