[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20261104130825.GR23438@brightrain.aerifal.cx>
Date: Wed, 4 Nov 2026 08:08:26 -0500
From: Rich Felker <dalias@...c.org>
To: Mahdi Rakhshandehroo <mahdi.rakhshandehroo@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] Fix potentially unbounded recursion in
strftime/strftime_l/wcsftime when fed with a crafted locale
On Wed, Nov 04, 2026 at 01:48:08AM -0800, Mahdi Rakhshandehroo wrote:
> (Please CC me on replies)
>
> __strftime_fmt_1() expands the %c, %x, %X and %r conversions by
> re-entering __strftime_l() with a format string fetched from the
> locale's LC_TIME data (D_T_FMT, D_FMT, T_FMT, T_FMT_AMPM) through
> __nl_langinfo_l(). Unlike %D/%F/%R/%T, which expand into fixed literal
> formats, these sub-formats come from the locale, so a catalog whose
> format contains a conversion leading back to the same item (directly,
> e.g. D_T_FMT = "%c", or through a cycle, e.g. D_T_FMT = "%x" with
> D_FMT = "%c") closes the cycle:
Locale data has to be trusted, and I don't think this is valid
contents for the data.
> __strftime_l() -> __strftime_fmt_1() -> __strftime_l()
>
> which then recurses without bound. The 100-byte intermediate buffer does
> not limit the recursion depth, since format expansion does not advance
> the output length.
>
> Recursion is triggered when the following criteria are met:
> - A LC_TIME locale from a crafted file under MUSL_LOCPATH is used
> - strftime(), strftime_l() or wcsftime() is invoked with n > 0 and a
> format string with %c/%x/%X/%r
>
> This patch bounds the recursion by threading a depth counter through the
> call cycle. The following changes are made:
>
> - strftime.c defines MAXIMUM_RECURSION_DEPTH with a value of 5. I
> consider this a sensible upper bound, as no reasonable locale should
> require that many levels of expansion.
There should never be any recursion here. I don't see the motive for
allowing some number of levels of it. A recursive definition is an
error in the locale definition.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
