GNU bug report logs - #16872
`date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 16872 in the body.
You can then email your comments to 16872 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mike Frysinger <vapier <at> gentoo.org>
To: bug-coreutils <at> gnu.org
Subject: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'` crashes
Date: Tue, 25 Feb 2014 03:13:52 -0500

[Message part 1 (text/plain, inline)]

as reported by Bertrand Jacquin, this crashes:
$ date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'
Segmentation fault

(gdb) bt
#0  0x00007ffff7ab1014 in __GI___libc_free (mem=0x7fffffffc8b0) at malloc.c:2942
#1  0x0000000000406730 in parse_datetime (result=result <at> entry=0x7fffffffcab0, p=<optimized out>, p <at> entry=0x7fffffffd04a "TZ=\"America/Los_Angeles\" \"00:00 + 1 hour\"", now=<optimized out>, now
@entry=0x0) at ./lib/parse-datetime.y:1307
#2  0x00000000004023c7 in main (argc=0x3, argv=0x7fffffffcc68) at src/date.c:522

that's 15fca2a02e38d69915c52ef41eee3c7d52b67f3e i happened to have already
built, but seems to reproduce easily across older versions.
-mike

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 16872 <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: Mike Frysinger <vapier <at> gentoo.org>
Cc: 16872 <at> debbugs.gnu.org
Subject: Re: bug#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'`
 crashes
Date: Tue, 25 Feb 2014 08:50:38 +0000

On 02/25/2014 08:13 AM, Mike Frysinger wrote:
> as reported by Bertrand Jacquin, this crashes:
> $ date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'
> Segmentation fault
> 
> (gdb) bt
> #0  0x00007ffff7ab1014 in __GI___libc_free (mem=0x7fffffffc8b0) at malloc.c:2942
> #1  0x0000000000406730 in parse_datetime (result=result <at> entry=0x7fffffffcab0, p=<optimized out>, p <at> entry=0x7fffffffd04a "TZ=\"America/Los_Angeles\" \"00:00 + 1 hour\"", now=<optimized out>, now
> @entry=0x0) at ./lib/parse-datetime.y:1307
> #2  0x00000000004023c7 in main (argc=0x3, argv=0x7fffffffcc68) at src/date.c:522
> 
> that's 15fca2a02e38d69915c52ef41eee3c7d52b67f3e i happened to have already
> built, but seems to reproduce easily across older versions.
> -mike
> 

Ugh. Reproducible here.
I'll fix up the issue in gnulib.

thanks!
Pádraig.

Message #11 received at 16872 <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: Mike Frysinger <vapier <at> gentoo.org>
Cc: 16872 <at> debbugs.gnu.org, bug-gnulib <bug-gnulib <at> gnu.org>
Subject: Re: bug#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'`
 crashes
Date: Tue, 25 Feb 2014 11:11:26 +0000

[Message part 1 (text/plain, inline)]

On 02/25/2014 08:50 AM, Pádraig Brady wrote:
> On 02/25/2014 08:13 AM, Mike Frysinger wrote:
>> as reported by Bertrand Jacquin, this crashes:
>> $ date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'
>> Segmentation fault
>>
>> (gdb) bt
>> #0  0x00007ffff7ab1014 in __GI___libc_free (mem=0x7fffffffc8b0) at malloc.c:2942
>> #1  0x0000000000406730 in parse_datetime (result=result <at> entry=0x7fffffffcab0, p=<optimized out>, p <at> entry=0x7fffffffd04a "TZ=\"America/Los_Angeles\" \"00:00 + 1 hour\"", now=<optimized out>, now
>> @entry=0x0) at ./lib/parse-datetime.y:1307
>> #2  0x00000000004023c7 in main (argc=0x3, argv=0x7fffffffcc68) at src/date.c:522
>>
>> that's 15fca2a02e38d69915c52ef41eee3c7d52b67f3e i happened to have already
>> built, but seems to reproduce easily across older versions.
>> -mike
>>
> 
> Ugh. Reproducible here.
> I'll fix up the issue in gnulib.

Proposed patch attached.

thanks,
Pádraig.

[date-tz-crash.patch (text/x-patch, attachment)]

Message #14 received at 16872 <at> debbugs.gnu.org (full text, mbox):

From: Bernhard Voelker <mail <at> bernhard-voelker.de>
To: Pádraig Brady <P <at> draigBrady.com>, 
 Mike Frysinger <vapier <at> gentoo.org>
Cc: 16872 <at> debbugs.gnu.org, bug-gnulib <bug-gnulib <at> gnu.org>
Subject: Re: bug#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'`
 crashes
Date: Thu, 27 Feb 2014 22:48:00 +0100

On 02/25/2014 12:11 PM, Pádraig Brady wrote:
> Proposed patch attached.

parse_datetime per se is pretty ugly, however, the fix LGTM:
+1

Thanks!

Have a nice day,
Berny

Message #19 received at 16872-done <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: Bernhard Voelker <mail <at> bernhard-voelker.de>
Cc: bug-gnulib <bug-gnulib <at> gnu.org>, Mike Frysinger <vapier <at> gentoo.org>,
 16872-done <at> debbugs.gnu.org
Subject: Re: bug#16872: `date -d 'TZ="America/Los_Angeles" "00:00 + 1 hour"'`
 crashes
Date: Thu, 27 Feb 2014 23:58:33 +0000

[Message part 1 (text/plain, inline)]

On 02/27/2014 09:48 PM, Bernhard Voelker wrote:
> On 02/25/2014 12:11 PM, Pádraig Brady wrote:
>> Proposed patch attached.
> 
> parse_datetime per se is pretty ugly, however, the fix LGTM:
> +1

I've pushed that to gnulib,
and the attached to coreutils.

thanks for the review,
Pádraig.

[coreutils-date-crash.patch (text/x-patch, attachment)]

Message #26 received at 16872 <at> debbugs.gnu.org (full text, mbox):

From: Eric Blake <eblake <at> redhat.com>
To: 16872 <at> debbugs.gnu.org
Subject: Re: [oss-security] parse_datetime() bug in coreutils
Date: Mon, 05 Jan 2015 10:29:55 -0700

[Message part 1 (text/plain, inline)]

For informational purposes: this bug has been assigned a CVE

On 01/03/2015 03:19 PM, cve-assign <at> mitre.org wrote:
> 
> On Mon, 29 Dec 2014, Moritz Mühlenhoff wrote:
> 
>> On Mon, Nov 24, 2014 at 06:47:24PM -0800, Seth Arnold wrote:
>>> Hello,
>>>
>>> Fiedler Roman discovered that coreutils' parse_datetime() function
>>> has some flaws that may be exploitable if the date(1), touch(1),
>>> or potentially other programs, accept untrusted input for certain
>>> parameters. While researching this issue, he discovered that it
>>> was independantly discovered by Bertrand Jacquin and reported at
>>> http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872
>>>
>>> $ touch '--date=TZ="123"345" @1'
>>> Segmentation fault (core dumped)
>>> $ date '--date=TZ="123"345" @1'
>>> *** Error in `date': double free or corruption (out):
>>> 0x00007fffc9866c20 ***
>>> Aborted (core dumped)
>>> $
>>>
>>> The GNU bugtracker has this patch to fix the problem:
>>> http://debbugs.gnu.org/cgi/bugreport.cgi?msg=11;filename=date-tz-crash.patch;att=1;bug=16872
>>>
>>> and this patch to include the fix in coreutils and a small test case:
>>> http://debbugs.gnu.org/cgi/bugreport.cgi?msg=19;filename=coreutils-date-crash.patch;att=1;bug=16872
>>>
>>>
>>> Can a CVE please be assigned for this issue.
> 
> Use CVE-2014-9471.
> 
> ---
> 
> CVE assignment team, MITRE CVE Numbering Authority M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through http://cve.mitre.org/cve/request_id.html ]

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

[signature.asc (application/pgp-signature, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.