Check strftime(3) return value in all cases.

Old versions of strftime(3) didn't guarantee to NUL-terminate the buffer
so we explicitly clear the last byte of the buffer and check it.
This commit is contained in:
Todd C. Miller
2021-09-17 14:01:28 -06:00
parent 698481492c
commit 55171df5e5
10 changed files with 105 additions and 47 deletions

View File

@@ -620,8 +620,9 @@ sudo_debug_write2_v1(int fd, const char *func, const char *file, int lineno,
struct tm tm;
size_t tlen;
if (localtime_r(&now, &tm) != NULL) {
timebuf[sizeof(timebuf) - 1] = '\0';
tlen = strftime(timebuf, sizeof(timebuf), "%b %e %H:%M:%S", &tm);
if (tlen == 0) {
if (tlen == 0 || timebuf[sizeof(timebuf) - 1] != '\0') {
/* contents are undefined on error */
timebuf[0] = '\0';
} else {