Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 23 Apr 2015 21:11:11 -0700
From: Isaac Dunham <ibid.ag@...il.com>
To: musl@...ts.openwall.com
Subject: Re: setenv if value=NULL, what say standard? Bug?

On Wed, Apr 22, 2015 at 10:15:07PM -0400, Rich Felker wrote:
> On Wed, Apr 22, 2015 at 09:26:57PM -0400, Jean-Marc Pigeon wrote:
> > The application is not careful enough, but not incorrect as such.
> 
> It's definitely incorrect. It's doing something that invokes undefined
> behavior.
> 
> > Note: we may have tons of applications with the same problem.
> > if we keep musl setenv like that, musl will be seen as quite unreliable.

I sent a patch that checks that getenv("TZUTC") is not null before using
it to the util-linux, and one of the developers proposed a different fix:
get rid of TZUTC usage altogether.

Apparently, this was introduced in 2013 by someone who wanted to use
the "right" (zoneinfo-leaps) timezone database, but didn't understand
the correct way to set it up. It happens to have been a drive-by patch
that had no updates for the public documentation, for what that's worth.

Instead of setting TZUTC (presumably to ":right/UTC" or equivalent),
the *proper* approach to using the "right" database is to set TZDIR
to /usr/share/zoneinfo/right or /usr/share/zoneinfo-leaps (depending
on your distro's packaging of tzdata), or to copy all the files into
/usr/share/zoneinfo/.
According to hwclock(8), the tzdata maintainers moved
/usr/share/zoneinfo/right to /usr/share/zoneinfo-leaps in order to
discourage people from using TZ=:right/...; this format makes it
inconvenient to mix zones on a single machine, since you cannot mix
and match "right" and "posix" without getting unexpeccted results.

tl;dr: it's not old code but a recent (2-year old) undocumented addition,
apparently done without checking the proper way to set up tzdata with
leap seconds. It is thus redundant with TZDIR, besides relying on a use
of TZ that is conceptually broken.
If someone throws together quick hacks without reading the documentation,
breakage may be expected even if they test it, since there's no guarantee
that everything everywhere will work like the few test systems one person
has for an indefinate length of time.

Thanks,
Isaac Dunham

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.