Re: [PATCH 5/5] log: do not segfault on gmtime errors

From: Jeff King <peff@peff.net>
Date: Mar 24, 2014, 21:33 UTC
Message-ID: <20140324213342.GE13728@sigill.intra.peff.net>
In-Reply-To: <532D58B5.1080309@web.de>

On Sat, Mar 22, 2014 at 10:32:37AM +0100, René Scharfe wrote:

Show 7 quoted lines

> >This test is of questionable portability, since we are depending on
> >gmtime's arbitrary point to decide that our input is crazy and return
> >NULL. The value is sufficiently large that I'd expect most to do so,
> >though, so it may be safe.
> 
> Just came around to testing on FreeBSD 10 amd64; the new test in t4212 fails
> there:

Thanks for the report. I don't think the problem is in the test here, but rather that we should do a more thorough job of detecting gmtime's "I don't know what to do with this" response.

Show 12 quoted lines

> >@@ -184,8 +184,10 @@ const char *show_date(unsigned long time, int tz, enum date_mode mode)
> >  		tz = local_tzoffset(time);
> >
> >  	tm = time_to_tm(time, tz);
> >-	if (!tm)
> >-		return NULL;
> >+	if (!tm) {
> 
> Would it make sense to work around the FreeBSD issue by adding a check like
> this?
> 
> 	if (!tm || tm->tm_year < 70) {

That feels like a bit of a maintenance headache. Right now we do not internally represent times prior to the epoch, since we mostly use "unsigned long" through the code. So anything < 70 has to be an error. But it would be nice one day to consistently use a 64-bit signed time_t throughout git, and represent even ancient timestamps (e.g., for people doing historical projects, like importing laws into git). This would set quite a trap for people working later on the code.

If the result is all-zeroes, can we check for that case instead? I suppose that will eventually create a "trap" at midnight on January 1st of the year 0 (though I am not sure such a date is even meaningful, given the history of our calendars).

-Peff