On 28/10/2026 12:36, CHEN LINGFENG wrote:
Dear maintainer,
Thank you for your work on maintaining GNU Coreutils.
I would like to report a potential security issue in pr. A specially crafted -D
date format can cause an integer wraparound in nstrftime, resulting in an
extremely large size being passed to memset.
The issue is still reproducible on the latest Coreutils 9.12 release.
Minimal reproducer
pr -D'%+_1z' /dev/null
That even crashes without ASAN.
A possible fix would be to calculate shortage using the signed sbyte_count_t
type before determining the padding size.
Yes, that looks like a correct fix, since all the other types in the expression
are signed.
There is another related issue I noticed a few lines below that
where padding limit isn't checked before writing.
That can be triggered with:
ls -l --time-style='+%_10000z' /dev/null
It looks like we can just use incr_overflow() to avoid that,
and move the memset after that check.
It seems the padding limit check was inadvertently removed in commit
1c740444c922.
We'll fix these 2 issues up in gnulib.
thanks,
Padraig
