glusterfs icon indicating copy to clipboard operation
glusterfs copied to clipboard

time parsing issues in cli-cmd-parser.c config_parse

Open eggert opened this issue 3 months ago • 0 comments

Description of problem: In cli/src/cli-cmd-parserlc, config_parse uses strftime's %s format in an unportable way. It calls strftime %s with a struct tm that may have out-of-range values, which has unspecified behavior according to POSIX. There is also a time zone portability issue.

Instead of calling strftime with %s to format a struct tm and then convert the resulting time_t value to a string suitable for giving to sprintf %s, the code should simply call mktime and check for mktime failures, and then us sprintf %lld to format the time_t. I plan to issue a pull request shortly about this.

The exact command to reproduce the issue: I found the problem by code inspection. You should be able to reproduce abug by using wayyyy out-of-range dates (e.g., year == 2147485547) and/or in non-UTC timezones. Not sure it's worth the trouble to come up with test cases.

The full output of the command that failed: See above.

Expected results: See above.

Mandatory info: - The output of the gluster volume info command: Bug found by code inspection.

- The output of the gluster volume status command: Bug found by code inspection.

- The output of the gluster volume heal command: Bug found by code inspection.

**- Provide logs present on following locations of client and server nodes - Bug found by code inspection.

**- Is there any crash ? Provide the backtrace and coredump There could be a crash in theory, with out-of-range years. The call to strftime does not necessarily conform to POSIX.1-2017 so the behavior is unspecified. However, in practice the behavior will most likely just go ahead with a wildly-wrong timestamp.

Additional info:

- The operating system / glusterfs version: Any.

Note: Please hide any confidential data which you don't want to share in public like IP address, file name, hostname or any other configuration

eggert avatar May 23 '24 21:05 eggert