[issue24917] time_strftime() Buffer Over-read

[Marc-Andre Lemburg]

Marc-Andre Lemburg added the comment:

On 05.09.2015 03:49, Alexander Belopolsky wrote:
> 
> Alexander Belopolsky added the comment:
> 
> Hmm, on Mac OSX "%" and "A%" are valid format strings:
> 
>>>> time.strftime("%")
> '%'
>>>> time.strftime("A%")
> 'A%'
> 
> Mark's experiments show that on Windows they are not. What about the other platforms affected by the patch?  I am concerned about the bottom part of the patch.

Trailing '%' are valid on Linux, just as using unsupported format
codes (those as passed through as is).

On Windows, the C lib strftime() segfaults with a trailing '%', just
as it does with unsupported format codes.

I have this code in mxDateTime to check for this:

static
int _mxDateTime_CheckWindowsStrftime(char *fmt,
				     struct tm *tm)
{
    char *p;

    /* Range checks */
    Py_Assert(tm->tm_sec < 60,
	      PyExc_ValueError,
	      ".strftime() cannot format leap seconds on Windows");
    Py_Assert(tm->tm_mday <= 31,
	      PyExc_ValueError,
	      ".strftime() cannot format days > 31 on Windows");

    /* Scan format string for invalid codes */
    for (p = fmt; *p != '\0'; p++) {
	register char code;
	if (*p != '%')
	    continue;
	code = *++p;
	/* Check for supported format codes; see
	   https://msdn.microsoft.com/en-us/library/fe06s4ak.aspx */
	switch (code) {
	case 'a':
	case 'A':
	case 'b':
	case 'B':
	case 'c':
	case 'd':
	case 'H':
	case 'I':
	case 'i':
	case 'm':
	case 'M':
	case 'p':
	case 'S':
	case 'U':
	case 'w':
	case 'W':
	case 'x':
	case 'X':
	case 'y':
	case 'Y':
	case 'z':
	case 'Z':
	case '%':
	    continue;
	case '\0':
	    Py_Error(PyExc_ValueError,
		     "format string may not end with a '%' character "
		     "on Windows");
	default:
	    Py_ErrorWithArg(PyExc_ValueError,
			    "format code '%c' not supported on Windows",
			    code);
	}
    }
    return 0;

  onError:
    return -1;
}

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue24917>
_______________________________________