log: handle integer overflow in timestamps

If an ident line has a ridiculous date value like (2^64)+1, we currently just pass ULONG_MAX along to the date code, which can produce nonsensical dates. On systems with a signed long time_t (e.g., 64-bit glibc systems), this actually doesn't end up too bad. The ULONG_MAX is converted to -1, we apply the timezone field to that, and the result ends up somewhere between Dec 31, 1969 and Jan 1, 1970. However, there is still a few good reasons to detect the overflow explicitly: 1. On systems where "unsigned long" is smaller than time_t, we get a nonsensical date in the future. 2. Even where it would produce "Dec 31, 1969", it's easier to recognize "midnight Jan 1" as a consistent sentinel value for "we could not parse this". 3. Values which do not overflow strtoul but do overflow a signed time_t produce nonsensical values in the past. For example, on a 64-bit system with a signed long time_t, a timestamp of 18446744073000000000 produces a date in 1947. We also recognize overflow in the timezone field, which could produce nonsensical results. In this case we show the parsed date, but in UTC. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Feb 24, 2014 at 02:46 UTC 1dca155fe3fac29e847d2d8ff1087d892a129a9c
2 files changed +24 -2
pretty.c
+8 -2
@@ -401,8 +401,14 @@ static const char *show_ident_date(const struct ident_split *ident,
401
402 if (ident->date_begin && ident->date_end)
403 date = strtoul(ident->date_begin, NULL, 10);
404 - if (ident->tz_begin && ident->tz_end)
405 - tz = strtol(ident->tz_begin, NULL, 10);
404 + if (date_overflows(date))
405 + date = 0;
406 + else {
407 + if (ident->tz_begin && ident->tz_end)
408 + tz = strtol(ident->tz_begin, NULL, 10);
409 + if (tz == LONG_MAX || tz == LONG_MIN)
410 + tz = 0;
411 + }
412 return show_date(date, tz, mode);
413 }
414
t/t4212-log-corrupt.sh
+16
@@ -60,4 +60,20 @@ test_expect_success 'unparsable dates produce sentinel value (%ad)' '
60 test_cmp expect actual
61 '
62
63 +# date is 2^64 + 1
64 +test_expect_success 'date parser recognizes integer overflow' '
65 + commit=$(munge_author_date HEAD 18446744073709551617) &&
66 + echo "Thu Jan 1 00:00:00 1970 +0000" >expect &&
67 + git log -1 --format=%ad $commit >actual &&
68 + test_cmp expect actual
69 +'
70 +
71 +# date is 2^64 - 2
72 +test_expect_success 'date parser recognizes time_t overflow' '
73 + commit=$(munge_author_date HEAD 18446744073709551614) &&
74 + echo "Thu Jan 1 00:00:00 1970 +0000" >expect &&
75 + git log -1 --format=%ad $commit >actual &&
76 + test_cmp expect actual
77 +'
78 +
79 test_done