tzset_basic: only call issetugid(2) if TZ has changed
If we are just going to return without parsing TZ, there is no need
to call issetugid(2) first. We only need to call issetugid(2) the
first time TZ is checked or when the value of TZ has changed.
Previously, we called issetugid(2) for every call to the functions
described by localtime(3). OK deraadt@

Allow TZ to contain absolutes paths starting with /usr/share/zoneinfo/
Other absolutes paths are still rejected.

POSIX timzone specs may contain '.' so only reject names containing '../'.
Noted by pjanzen@ with input from deraadt@.

tzset: ignore TZ if it contains an absolute path or issetugid().
Reading time zone files from user-controlled paths can result in
pledge(2) or unveil(2) violations. We also ignore files that contain
a '.' character to avoid paths containing ".." or hidden files.
Work with and OK deraadt@

No need to include float.h anymore.

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

Allow TZ to contain absolutes paths starting with /usr/share/zoneinfo/
Other absolutes paths are still rejected.

POSIX timzone specs may contain '.' so only reject names containing '../'.
Noted by pjanzen@ with input from deraadt@.

tzset: ignore TZ if it contains an absolute path or issetugid().
Reading time zone files from user-controlled paths can result in
pledge(2) or unveil(2) violations. We also ignore files that contain
a '.' character to avoid paths containing ".." or hidden files.
Work with and OK deraadt@

No need to include float.h anymore.

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

POSIX timzone specs may contain '.' so only reject names containing '../'.
Noted by pjanzen@ with input from deraadt@.

tzset: ignore TZ if it contains an absolute path or issetugid().
Reading time zone files from user-controlled paths can result in
pledge(2) or unveil(2) violations. We also ignore files that contain
a '.' character to avoid paths containing ".." or hidden files.
Work with and OK deraadt@

No need to include float.h anymore.

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

tzset: ignore TZ if it contains an absolute path or issetugid().
Reading time zone files from user-controlled paths can result in
pledge(2) or unveil(2) violations. We also ignore files that contain
a '.' character to avoid paths containing ".." or hidden files.
Work with and OK deraadt@

No need to include float.h anymore.

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

No need to include float.h anymore.

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

When system calls indicate an error they return -1, not some arbitrary
value < 0. errno is only updated in this case. Change all (most?)
callers of syscalls to follow this better, and let's see if this strictness
helps us in the future.

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

Unifdef TM_GMTOFF TM_ZONE USG_COMPAT ALTZONE to make the code more readable.
No binary change when compiled with -g0.
Note that wcsftime.c did not even compile without TM_ZONE.
OK millert@

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them

Remove calloc cast, give sizeof parens. No functional change.

delete old lint ARGSUSED comments

Move #includes from private.h to the .c files that need them, getting rid of
several. Switch from FILENAME_MAX to PATH_MAX (it's for open(), not fopen()).

ok deraadt@ tedu@ krw@

Don't wrap initialized variables: binutils appears to be mishandling them
on arm and m88k

problems with optind observed by jsg@

Wrap <time.h> so that internal calls go direct and symbols not in C99 are weak
Add prototypes to localtime.c for offtime(), time2posix(), posix2time() to
reduce noise with -Wmissing-prototypes
Eliminate unnecessary #includes

Remove obsolete timezone() function.
Add timezone and daylight symbols for XSI compatibility.

sprinkle braces around multi line statements

pull scopes without conditionals up into enclosing block

knf indents to give me a fighting chance at differentiating new blocks
from continuation lines, of which there are many

drop an ansi bomb on the function definitions

remove CMU gtime

it is not strictly necessary to cast the "return value" of free() to void.

- register int idays; /* unsigned would be so 2003 */
+ int idays; /* unsigned would be so 2003 */

register is so 1973

always define ALL_STATE (which, contrary to the name is not about all
states, but rather heap allocating the state) and unifdef the rest

the one true type of time_t is a signed integer

remove INITIALIZE macro and do it the hard way.

move include lines around a bit

replace homegrown is_digit with correct calls to isdigit()

this removes just a few ifdef checks for things that should always be enabled,
and which we definitely don't want to workaround. no change in the compiled
code (yet).
some of these, like the first chunk are plain silly. the compiler used to
compile asctime has nothing to do with the format strings strftime should
support.
ok deraadt

add some prototypes, casts, includes, parenthesis, and whatnot to
silence some warnings.

Update to tzcode2011g from elsie.nci.nih.gov.

replace a large stack buffer with a malloc call, with help from matthew.
ok deraadt
[passed upstream to the tz list as well]

update to tzcode2010k from elsie.nci.nih.gov; OK miod@

Update to tzcode 2008a from elsie.nci.nih.gov

update to tzcode2007j from elsie.nci.nih.gov; mostly ANSIfication

Update to tzcode2007a. This adds support for 64bit time_t in case
we need it in the future. All of our platforms currently have 32bit
time_t types. This also extends the timezone data file format to
support both 32bit and 64bit data. The 64bit data is located after
the 32bit data so binaries linked with the older tzcode simply won't
look at it. A version field in the file header is used to determine
whether the data file is the old or extended format. OK miod@

Update to tzcode2006a; primarily just cast and const fixes.

Re-add the change from tzcode2005c, this time with an added bounds
check from Arthur David Olson that fixes a possible infinite loop.

Back out a change from tzcode2005c that can cause an infinite loop in mktime().

Do not ignore return value of localsub() in localtime_r()

zap remaining rcsid.

Kill old files that are no longer compiled.

okay theo

Update to tzcode2005j.

Update to tzcode2004e from elsie.nci.nih.gov

merge in tzcode2004a

Update to tzcode2003c from elsie.nci.nih.gov
Fixes a pasto and implements better int oflow checking (doesn't rely on
unspecified behavior).

a few more strlcy; ok from beck & ho

Minor updates from tzcode2002c

use strlcpy vs strncpy+a[len-1]='\0'. millert@ ok.

sync with ftp://elsie.nci.nih.gov/pub/tzcode2000c.tar.gz, millert@ ok

_THREAD_PRIVATE_* macros changed

Back out rev 1.7. PCTS 151-2 still passes, and mktime() now correctly returns
-1 for calendar times that cannot be represented.

typo

sync with tzcode1999a

Add thread-safety to libc, so that libc_r will build (on i386 at least).
All POSIX libc api now there (to P1003.1c/D10)
(more md stuff is needed for other libc/arch/*)
(setlogin is no longer a special syscall)
Add -pthread option to gcc (that makes it use -lc_r and -D_POSIX_THREADS).
Doc some re-entrant routines
Add libc_r to intro(3)
dig() uses some libc srcs and an extra -I was needed there.
Add more md stuff to libc_r.
Update includes for the pthreads api
Update libc_r TODO

be... slightly more permissive.. but i think this is right, i looked at it for 5 minutes

do not let :relative paths through (how did i miss this before)

tzcode1998b from ftp://elsie.nci.nih.gov/pub

correctly code the classes of permitted TZ specifications for the
issetugid() case. thanks bitblt and tholo

Remove unnecesary local changes. The strncpy()'s are safe because
the string is static and so the last element is always init'd to
zero.

Update to tzcode1996o + our fixes. Fixes problem pointed out
by cross@va.pubnix.com.

iUpdate to pass FIPS 151-2 tests

1 char oflow

use issetugid()

Fix RCS ids
Make sure everything uses {SYS,}LIBC_SCCS properly

new common tz code

from netbsd; sync with tzcode96a

branches: 1.1.1;
Initial revision

gmtime_r() should return NULL on failure, not the struct tm * result
parameter that was passed in. From Carlin Bingham.

Remove doaccess variable and access(2) call since this interfers with
applications like zdump(8) because pledge(2) doesn't allow access(2) to
/usr/share/zoneinfo.

millert@ better described why this call can go away:

"This looks like an attempt to do access checks based on the real uid instead
of the effective uid. Basically for setuid programs we don't want to allow a
user to set TZ to a path they should not be able to otherwise access.

However, we already have a check for issetugid() above so I think the doaccess
bits can just be removed and we can rely on open()."

After discussion with tb@, deraadt@ and millert@, this was also OK'ed by them