chrono

chrono copied to clipboard

In response to #578, there really isn't anything Chrono can do to actually prevent the invalid memory accesses in libc -- all we can do is tell people not to set env vars. In my experience and from conversations surrounding this issue, setting env vars is rare and definitely just shouldn't be done once the process has more than one thread running. Hopefully isn't an an awful burden on users, either in terms of feature reduction or of security scanning.

segfault or crash in other interesting ways would it not be better to explicitly mention data races and undefined behaviour?

If this is going to be accepted I feel like at the very least these functions should be deprecated and have unsafe counterparts.

I agree the docs should say something about the issue with reading the TZ environment variable and our history with RUSTSEC-2020-0159. But since it is fixed with https://github.com/chronotope/chrono/pull/677 we should say something different from the changes in this PR.